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PREVENTING WASTE, FRAUD, ABUSE, AND 
MISMANAGEMENT IN HOMELAND SECU- 
RITY— A GAO HIGH-RISK LIST REVIEW 


Wednesday, May 7, 2014 

U.S. House of Representatives, 

Committee on Homeland Security, 

Washington, DC. 

The committee met, pursuant to call, at 10:09 a.m., in Room 311, 
Cannon House Office Building, Hon. Michael T. McCaul [Chairman 
of the committee] presiding. 

Present: Representatives McCaul, Broun, Duncan, Hudson, San- 
ford, Thompson, Clarke, Richmond, Payne, and O’Rourke. 

Chairman McCaul. Committee on Homeland Security will come 
to order. Committee is meeting today to examine testimony regard- 
ing the prevention of waste, fraud, abuse, and mismanagement at 
the Department of Homeland Security. I recognize myself for an 
opening statement. 

While the Department of Homeland Security’s mission is critical, 
it is also critical that it keeps its finances in check because in order 
to protect the homeland we must maximize every dollar spent. Al- 
most as soon as the Department’s creation, the Government Ac- 
countability Office placed some of DHS’s programs on its high-risk 
list, and today many remain. 

This list is developed every 2 years by watchdogs at GAO to 
identify areas in the Federal Government that are high-risk to 
fraud, waste, abuse, and mismanagement, or are in the most need 
of broad reform. It is intended to draw attention to these areas to 
force agency leaders to improve. 

Unfortunately some of the programs identified include some of 
the Department’s core functions such as acquisitions, management, 
financial management, information technology, human capital and 
management integration, as well as multi-agency challenges such 
as information sharing and cybersecurity. 

While the Department has devoted time to addressing GAO’s 
high-risk areas, these reports continue to show examples of pro- 
grams ignoring best practices and putting taxpayer dollars at risk. 

Recent GAO findings have identified challenges with the Arizona 
Border Surveillance Technology Plan, TSA body scanners, mod- 
ernization of key border enforcement system known as TECS, and 
the Department’s acquisition funding plans. 

All levels of DHS must be fully committed to make the Depart- 
ment more efficient and effective. To this end, this committee has 

( 1 ) 
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taken action to address specific issues highlighted in GAO’s high- 
risk report. 

H.R. 3696, the National Cybersecurity and Critical Infrastruc- 
ture Protection Act, and H.R. 4228, the DHS Acquisition Account- 
ability and Efficiency Act both passed out of this committee unani- 
mously and are important pieces of legislation to increase our Na- 
tion’s cybersecurity and improve the Department’s management of 
its acquisition programs. 

Additionally, our recent bipartisan report on the Boston bomb- 
ings highlighted the need for improved information sharing, which 
addresses another high-risk item. 

Finally, while I am encouraged by the steps taken by DHS in re- 
cent years to address these issues, including achieving a clean 
audit opinion in 2013, there is clearly much more work to be done. 
In the short time since they have assumed their new positions. Sec- 
retary Johnson and Deputy Secretary Mayorkas have both already 
endeavored to fix the management problems at DHS. Today I look 
forward to hearing from them on their plans to improve the De- 
partment. 

However, assurances from the top and putting plans in place 
only go so far. It will take time and follow-up and continued over- 
sight to ensure improved outcomes are sustained over multiple 
years. To that end I look forward to Comptroller General Dodaro 
and recently-confirmed DHS Inspector General Roth’s testimony 
today. Their recommendations to make DHS a more effective and 
efficient organization are essential to making Americans safer. 

Ultimately every dollar wasted on mismanagement is one less 
that can go to the men and women protecting our borders, tar- 
geting terrorists, securing our airports, and patrolling our shores. 
That is why this hearing and DHS’s commitment to getting its 
house in order is so important. 

[The statement of Chairman McCaul follows:] 

Statement of Chairman Michael T. McCaul 
May 7, 2014 

While the Department of Homeland Security’s mission is critical, it is also critical 
that it keeps its finances in check, because in order to protect the homeland we 
must meiximize every dollar spent. 

Almost as soon as the Department’s creation, the Government Accountability Of- 
fice (GAO) placed some of DHS’s programs on its “High-Risk List,” and today, many 
remain. This list is developed every 2 years by the watchdogs at GAO to identify 
areas in the Federal Government that are at high risk to fraud, waste, abuse, and 
mismanagement or are in most need of broad reform, and it is intended to draw 
attention to these areas to force agency leaders to improve. 

Unfortunately, some of the programs identified include some of the Department’s 
core functions such as acquisition management, financial management, information 
technology, human capital, and management integration, as well as, multi-agency 
challenges such as information sharing and cybersecurity. 

While the Department has devoted time to addressing GAO’s High-Risk areas, 
these reports continue to show examples of programs ignoring best practices and 
putting tcixpayer dollars at risk. Recent GAO findings have identified challenges 
with the Arizona Border Surveillance Technology Plan, TSA body scanners, mod- 
ernization of a key border enforcement system known as TECS, and the Depart- 
ment’s acquisition funding plans. All levels of DHS must be fully committed to mak- 
ing the Department more efficient and effective. 

To this end, this committee has taken action to address specific issues highlighted 
in GAO’s High-Risk report. H.R. 3696, the National Cybersecurity and Critical In- 
frastructure Protection Act, and H.R. 4228, the DHS Acquisition Accountability and 
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Efficiency Act — both passed out of this committee unanimously — are important 
pieces of legislation to increase our Nation’s cybersecurity and improve the Depart- 
ment’s management of its acquisition programs. Additionally, our recent bipartisan 
report on the Boston bombings highlighted the need for improved information shar- 
ing, which addresses another High-Risk item. 

Finally, while I am encouraged by the steps DHS has taken in recent years to 
address these issues including achieving a clean audit opinion in 2013, there is 
clearly much more work to be done. In the short time since they’ve assumed their 
new positions. Secretary Johnson and Deputy Secretary Mayorkas have both al- 
ready endeavored to fix the management problems at DHS, and today I look forward 
to hearing more from them on his plan for improving the Department. However, as- 
surances from the top and putting plans in place only go so far. It will take time 
and follow-up and continued oversight to ensure improved outcomes are sustained 
over multiple years. 

To that end, I look forward to Comptroller General Dodaro and recently confirmed 
DHS Inspector General Roth’s testimony today. Their recommendations to make 
DHS a more effective and efficient organization are essential to making Americans 
safer. Ultimately, every dollar wasted on mismanagement is one less that can go 
to the men and women protecting our borders, targeting terrorists, securing our air- 
ports, and patrolling our shores. That’s why this hearing, and DHS’ commitment to 
getting its house in order, is so important. 

Chairman McCaul. With that the Chairman now recognizes the 
Ranking Member, Mr. Thompson. 

Mr. Thompson. Thank you, Mr. Chairman. I thank you for hold- 
ing today’s hearing. I also want to thank the comptroller general, 
deputy secretary, and inspector general for their testimonies today. 

Today’s hearing is to examine the Department of Homeland Se- 
curity’s management functions deemed high-risk by the Govern- 
ment Accountability Office, and the steps that the Department is 
taking to improve in these areas. At the beginning of each Con- 
gress the GAO releases its high-risk update, which focuses on 
agencies and programs that are vulnerable to waste, fraud, and 
abuse. 

Understandably when the Department was formed in 2003 it was 
placed on the high-risk list because of the challenges associated on 
transforming 22 legacy agencies into one new Federal department. 
It was also put on the high-risk list because its failures to effec- 
tively do so could present National security risks. 

Unfortunately, more than a decade after its inception the Depart- 
ment remains on the high-risk list. One reason is that the Depart- 
ment has struggled to integrate its management functions across 
all components. These integration challenges present diverse oper- 
ational and management problems at the Department at all levels. 

There has been general acceptance of the One DHS concept ad- 
vanced by the last Secretary of Homeland Security. But what is 
needed at this pivotal moment is a leader who will animate that 
slogan and put structures and procedures in place to fully integrate 
the Department. 

Secretary Johnson may well be that leader, but any reforms will 
be at the mercy of an entrenched and unhappy workforce and the 
clock. I look forward to working with Secretary Johnson to bring 
about needed reforms. 

For the first time since its inception, however, the Department 
received its first clean audit of all its financial statements for fiscal 
year 2013. As commendable as this may be, we must not overlook 
that the independent auditor did find continued weaknesses in the 
Department’s financial controls. 
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Another challenging area for the Department is its IT acquisi- 
tions and management. Over the years the Department has had 
varying success acquiring and implementing information tech- 
nology systems. Some systems have performed as promised, while 
others have failed to deliver capabilities and mission benefit. 

There is a need for the Department to strengthen its internal IT 
governance. GAO has noted that the Department has more work to 
do to fully address its IT management challenges such as finalizing 
policies and procedures associated with its new governance struc- 
ture. 

Finally, the Department spends approximately a quarter of its 
annual budget procuring goods and services in support of its home- 
land security missions. Yet since its inception, managing acquisi- 
tions has been a significant challenge for the Department. 

The management framework put in place by the prior DHS lead- 
ership has the potential for improving DHS acquisition manage- 
ment in significant ways. That is why I am pleased that this com- 
mittee was able to come together in a bipartisan fashion last week 
and pass H.R. 4228, the DHS Acquisition Accountability and Effi- 
ciency Act, which seeks to codify what has been deemed by the 
comptroller general and other watchdogs as successful, and seeks 
to close other gaps that exist. 

Mr. Chairman, I look forward to more ways that this committee 
can work to help advance the Department and help it achieve the 
goals of being fully integrated with clean financial audits and inter- 
nal management and oversight controls in its information tech- 
nology and acquisition departments. 

Given the pivotal role the Department has in protecting and pre- 
paring America, management challenges become a distraction and 
have grave consequences for our National security. Hence, it is my 
hope that the Department can continue to progress, and we can see 
a date when it is not a part of the GAO high-risk list. 

With that, Mr. Chairman, I yield back. Thank you. 

[The statement of Ranking Member Thompson follows:] 

Statement of Ranking Member Bennie G. Thompson 
May 7, 2014 

Today’s hearing is to examine the Department of Homeland Security’s manage- 
ment functions deemed high-risk by the Government Accountability Office and the 
steps that the Department is taking to improve in these areas. 

At the beginning of each Congress, the GAO releases its “High-Risk Update” 
which focuses on agencies and programs that are vulnerable to waste, fraud, and 
abuse. Understandably, when the Department was formed in 2003, it was placed on 
the “high-risk list” because of the challenges associated with transforming 22 legacy 
agencies into one new Federal Department. It was also put on the “high-risk list” 
because its failure to effectively do so could present National security risks. 

Unfortunately, more than a decade after its inception, the Department remains 
on the “high-risk list.” One reason is that the Department has struggled to integrate 
its management functions across all the components. These integration challenges 
present diverse operational and management problems at the Department at all lev- 
els. 

There has been general acceptance of the “One DHS” concept advanced by the last 
Secretary of Homeland Security but what is needed at this pivotal moment is a 
leader who will animate that slogan and put structures and procedures in place to 
fully integrate the Department. Secretary Johnson may well be that leader but any 
reforms will be at the mercy of an entrenched and unhappy workforce and the clock. 
I look forward to working with Deputy Secretary Mayorkas and Secretary Johnson 
to bring about needed reforms. 
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For the first time since its inception, the Department received its first clean audit 
on all its financial statements for fiscal year 2013. As commendable as this may be, 
we must not overlook that the independent auditor did find continued weakness in 
the Department’s financial controls. 

Another challenging area for the Department is IT acquisitions and management. 
Over the years, the Department has had varying success acquiring and imple- 
menting information technology systems; some systems have performed as promised 
while others have failed to deliver capabilities and mission benefits. There is a need 
for the Department to strengthen its internal IT governance. GAO has noted that 
the Department has more work to do to fully address its IT management challenges 
such as finalizing policies and procedures associated with its new governance struc- 
ture. 

Finally, the Department spends approximately a quarter of its annual budget pro- 
curing goods and services in support of its homeland security missions. Yet, since 
its inception, managing acquisitions has been a significant challenge for the Depart- 
ment. 

The management framework put in place by the Obama administration has the 
potential for improving DHS acquisitions management in significant ways. That is 
why I am pleased that this committee was able to come together in a bipartisan 
fashion last week and passed H.R. 4228, the “DHS Acquisition Accountability and 
Efficiency Act,” which seeks to codify what has been deemed by the Comptroller 
General and other watchdogs as successful and seeks to close other gaps that exist. 

I look forward to more ways that this committee can work to help advance the 
Department and help it achieve the goals of being fully integrated, with clean finan- 
cial audits, and internal management and oversight controls in its information tech- 
nology and acquisitions departments. 

Given the pivotal role the Department has in protecting and preparing America, 
management challenges become a distraction and have grave consequences for our 
National security. Hence, it is my hope that the Department can continue to 
progress and we can see a day when it is not a part of the GAO High-Risk list. 

Chairman McCaul. I thank the Ranking Member. Other Mem- 
bers I remind they may submit an opening statement for the 
record. 

We are pleased to have here today a distinguished panel of wit- 
nesses; first, the Honorable Alejandro Mayorkas, who was sworn in 
as deputy secretary of the Department of Homeland Security in De- 
cember 2013. 

Prior to his appointment he served as director of the Depart- 
ment’s United States Citizenship and Immigration Services. He led 
a workforce of 18,000 employees throughout more than 250 offices 
world-wide rector of the Department’s United States Citizenship 
and Immigration Services. 

Before joining DHS Mr. Mayorkas was a partner at a law firm. 
In 1998 he was appointed as the United States Attorney for the 
Central District of California. 

Thanks for being here today. 

Next we have the Honorable Gene Dodaro, who became the 
eighth comptroller general of the United States, and head of the 
United States Government Accountability Office. 

In December 2010, after serving in the capacity of “acting” since 
March 2008 as comptroller general he has helped oversee the de- 
velopment and issuance of hundreds of reports and testimonies 
each year to various committees and individual Members of Con- 
gress. These and other GAO products have led to hearings and leg- 
islation, billions of dollars in taxpayer savings, and improvements 
to a wide range of Government programs and services. 

Then last but not least, the Honorable John Roth. Let me men- 
tion it is Mr. Dodaro’s birthday today, and we wish you a happy 
birthday, as well. 
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Then last, Mr. John Roth, who assumed the post of inspector 
general for the Department of Homeland Security in March 2014. 
Previously he served as director of the Office of Criminal Investiga- 
tions at the Food and Drug Administration. Prior to that, he had 
a long and distinguished record and career with the Department of 
Justice beginning in 1987 as Assistant U.S. Attorney for the East- 
ern District of Michigan. 

It is great to see so many brethren DOJ on this panel. Their full 
written statements will appear on the record. The Chairman now 
recognizes Deputy Secretary Mayorkas for 5 minutes. 

STATEMENT OF ALEJANDRO N. MAYORKAS, DEPUTY 

SECRETARY, U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. Mayorkas. Thank you very much, Mr. Chairman. Mr. Chair- 
man and distinguished Members of this committee. I very much 
appreciate the opportunity to testify before you today. I feel privi- 
leged to appear before you as the deputy secretary of Homeland Se- 
curity. 

I pledged to this committee an open, transparent, and fully coop- 
erative Department. We deeply appreciate the work of this com- 
mittee and have profound respect for it. Strong oversight drives 
good Government, and we recognize and appreciate that. 

I also want to thank my fellow witnesses before you today, Mr. 
Dodaro and Mr. Roth, for the work that they perform and that 
their teams perform. We share a common goal of making the De- 
partment everything that it should be. 

Mr. Chairman, Ranking Member Thompson, and distinguished 
Members, I submitted to this committee written testimony, and I 
will not repeat it now. 

I do want to underscore one overriding fact, and that is my im- 
mense pride in working alongside the men and women of the De- 
partment of Homeland Security. Those incredibly dedicated individ- 
uals deserve a Department and deserve management functions and 
processes and institutions that bring out the best in them and en- 
able them to do their jobs at the highest levels of excellence to 
which they aspire. 

With that I look forward to the opportunity to answer whatever 
questions you might have. Thank you. 

[The prepared statement of Mr. Mayorkas follows:] 

Prepared Statement of Alejandro N. Mayorkas 
May 7, 2014 

Chairman McCaul, Ranking Member Thompson, and distinguished Members of 
the committee, thank you for the opportunity to appear before you as the deputy 
secretary of Homeland Security to testify on the subject of management at this im- 
portant hearing entitled “Preventing Waste, Fraud, Abuse and Mismanagement in 
Homeland Security — a GAO High-Risk List Review.” I, along with Secretary John- 
son, appreciate and welcome the committee’s continued focus on this subject and for 
the oversight you exercise. It is my firmly-held belief that good oversight not only 
delivers accountability critical to good government, but that it also drives innova- 
tion. Thank you, and thank you to the members of your staff. 

I also wish to express my gratitude to the U.S. Government Accountability Office 
(GAO). Under Comptroller General Gene Dodaro’s leadership, GAO has spent con- 
siderable time and energy providing our Department with its valued, independent 
assessment of our work in areas critical to the effective management of our re- 
sources and execution of our responsibilities. GAO has issued recommendations to 
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our Department that, collectively, help provide a blueprint for success. It is in re- 
sponse to GAO’s independent reviews and recommendations that in January 2011 
our Department issued the first Integrated Strategy for High Risk Management, an 
operational framework to address GAO’s recommendations. Since we issued the In- 
tegrated Strategy, we have updated it twice yearly to document the progress our De- 
partment has made in addressing GAO’s recommendations. It pleases me to note 
that we have come far in the last 5 years; today the Department eagerly engages 
with GAO about outstanding recommendations. We seek out GAO. 

Like the responsibility of the GAO to provide its independent assessment of the 
Department’s execution of responsibilities, it is the duty of the Office of the Inspec- 
tor General to deliver its own independent and high-quality review of Departmental 
functions. I am grateful to testify before you today alongside the Department’s new 
inspector general, John Roth. I look forward to supporting the work of Inspector 
General Roth and to ensuring the Department’s transparency and full cooperation 
as he and I work to improve and strengthen the Department in our respective roles. 

When I became the deputy secretary of DHS in late December 2013, the first ac- 
tion I took was to schedule a meeting with Comptroller General Dodaro. In our 
meeting I had the opportunity to also meet George Scott, the managing director of 
GAO’s Homeland Security and Justice team. Mr. Scott and I have met on several 
occasions since then, and he and his team are outstanding in their commitment to 
improving our Department. With Mr. Scott’s and his team’s independent efforts, 
with the oversight of GAO and that of this committee, DHS will mature and im- 
prove. 

The number of open GAO recommendations to DHS has decreased steadily and, 
significantly, in GAO’s latest High-Risk List update it narrowed the subject from 
“Implementing and Transforming DHS” to “Strengthening DHS Management Func- 
tions.” Additionally noteworthy is the fact that GAO stated in that update that our 
Department’s Integrated Strategy, “if implemented and sustained, provides a path 
for DHS to be removed from GAO’s High-Risk List.” DHS has made significant 
progress. 

At the same time, DHS has additional work to do. Since I became the deputy sec- 
retary I have invested considerable time in working with GAO and with my very 
talented and dedicated DHS colleagues to ensure that this additional work is done 
as effectively and swiftly as possible. Earlier this year, we developed specific action 
plans to address the 30 key outcomes GAO identified in the areas of management 
integration, human capital, information technology, financial management, and ac- 
quisitions. Our action plans now provide month-to-month goals that provide a better 
road map to success. Our development of these action plans provided us with the 
opportunity to freshly review our previous efforts and, in certain critical areas, to 
accelerate our time tables materially. 

STRENGTHENING DEPARTMENT OF HOMELAND SECURITY MANAGEMENT FUNCTIONS 

Before discussing the work that DHS has undertaken to make progress on key 
GAO High-Risk List areas, I wish to highlight the actions we have recently taken 
that speak to our Departmental commitment to sound management practices. On 
April 22, 2014, the Secretary sent a memorandum to Department leadership enti- 
tled, “Strengthening Departmental Unity of Effort.” The purpose of this effort is to 
capitalize on the many strengths of the Department, starting with the profes- 
sionalism, skill, and dedication of its people and the rich history and tradition of 
its components, while identifying ways to enhance the cohesion of the Department 
as a whole. The Secretary’s guidance is targeted at improvements to four main lines 
of effort: Inclusive senior leader discussion and decision-making forums that provide 
an environment of trust and transparency; strengthened fundamental and critical 
management processes for investment (including requirements, budget, and acquisi- 
tion processes) that look at cross-cutting issues across the Department; focused, col- 
laborative Departmental strategy, planning, and anal 3 d;ic capability that support 
more effective DHS-wide decision-making and operations; and, enhanced coordi- 
nated operations to harness the significant resources of the Department more effec- 
tively. Many of the elements of this effort are described below, as they cut across 
the several management areas discussed in GAO’s High-Risk List. 

GAO’s High-Risk List focus on “Strengthening DHS Management Functions” iden- 
tified the need to achieve progress in key management areas, including human cap- 
ital management, financial management, acquisitions, information technology, and 
management integration. The Department’s Integrated Strategy for High-Risk Man- 
agement provides the framework for our efforts to address GAO’s recommendations 
and integrate and strengthen our management infrastructure across the Depart- 
ment; our monthly action plans help ensure that we have goals and time lines to 
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help us deliver success in timely fashion. I would like to share with you our efforts 
in each key area of focus. 

Human Capital Management 

The Department of Homeland Security’s greatest asset is its dedicated and tal- 
ented workforce. GAO has identified areas in which the Department must mature 
its human capital systems to ensure that its workforce is properly equipped and 
supported to achieve the Department’s challenging missions. The Department, in 
turn, has accelerated time lines in its monthly action plans to achieve success in 
this critical area. 

The low employee morale in several parts of the Department is an area of par- 
ticular focus. Under the direction of Secretary Johnson, I am taking a series of steps 
to address the root causes of the low morale and to deliver for the workforce the 
Department it deserves. I have formed a steering committee comprised of personnel 
from each of the Department’s component agencies and from Department head- 
quarters to focus on, among other things, the following areas that the workforce has 
identified in the Federal Employee Viewpoint Survey and in other feedback vehicles 
as ones in which the Department can improve: 

• The hiring and promotion process. DHS employees have expressed concerns that 
the hiring and promotion process is sometimes opaque. The Department can 
build greater employee confidence in the process through greater transparency 
and communication and by setting clear hiring and promotion standards. 

• Training and professional development. DHS employees have expressed a desire 
for enhanced training opportunities to ensure they are equipped to perform 
their jobs at the highest levels of excellence. They also have sought professional 
development opportunities that will enable them to achieve the promotions or 
new opportunities to which they aspire. 

• Rewards and recognition. DHS employees perform extraordinary acts of patriot- 
ism and courage each and every day throughout the Nation and the world. They 
deserve to be recognized, rewarded, and championed for their achievements. 
The Department is reintroducing the Secretary’s annual awards to recognize 
outstanding individual and team achievements from across the Department. In 
addition, the Department will institutionalize the practice of regularly cham- 
pioning its workforce and rewarding them when appropriate. 

• Performance management. Performance management is a critical tool in pro- 
moting priorities and values and driving accountability. The steering committee 
will focus on ensuring that each component and office in the Department has 
a performance management system that reflects the appropriate measures of 
success and drives each employee to achieve that success. 

Financial Management 

In fiscal year 2013, DHS achieved an historic unqualified clean audit opinion of 
all five financial statements, a confirmation of DHS’s on-going commitment to sound 
financial management practices. This benchmark represented a huge accomplish- 
ment for the many DHS employees who work every day to increase transparency 
and accountability for the teixpayer resources entrusted to the Department. Ameri- 
cans have the right to expect that we will be responsible stewards of every home- 
land security dollar with which we are entrusted. 

The Department expects to sustain this progress and receive its second clean 
audit opinion for fiscal year 2014. In the past 4 years, DHS has also eliminated 10 
audit qualifications, reduced Department-wide material weaknesses in internal con- 
trols over financial reporting from 10 to 4, and significantly reduced the number of 
component conditions contributing to material weaknesses from 25 to 2. The Depart- 
ment is executing a multi-year plan to achieve an unqualified clean opinion for in- 
ternal control of financial reporting by fiscal year 2016. 

Financial system modernization is a priority area for the Department. DHS is exe- 
cuting specific modernization efforts in order to meet the Department’s mission 
while minimizing and eliminating spending in duplicative systems. The current 
strategy conforms to guidance from the Office of Management and Budget to use 
shared services where possible and to split modernization projects into smaller, sim- 
pler segments with clear deliverables. One of our challenges in the shared services 
domain is that no one Federal agency has sufficient capacity to house all of the De- 
partment’s financial management data. As a result, we are evaluating the capabili- 
ties of the Federal agencies who offer shared services arrangements. The DHS Chief 
Financial Officer has established enterprise-wide standards for each component to 
follow and has prioritized a deployment strategy based on those components with 
the highest business needs. 



9 


Acquisitions Management 

The strategic decisions of the Department’s senior leadership are only as good as 
the processes that support and give effect to those decisions in investments and in 
the conduct of operations. Historically, DHS has generally developed and executed 
component-centric requirements, which has resulted in inefficient use of limited re- 
sources. Much work has been done to date in the areas of joint requirements anal- 
ysis, program and budget review, and acquisition oversight, including an effort over 
the past 4 years by the DHS Management Directorate to improve the Department’s 
overall acquisitions process and reform even the earliest phase of the investment 
life cycle where requirements are first conceived and developed. The Secretary’s 
April 22, 2014 memorandum on “Strengthening Departmental Unity of Effort” fo- 
cuses and reinforces existing structures and creates new capability, where needed, 
as identified in the recent Integrated Investment Life Cycle Management (IILCM) 
pilot study and other process analyses that examined the linkages between these 
inter-related planning processes and operations. These analyses underscored the 
need to further stren^hen all elements of the process, particularly the up-front de- 
velopment of strategy, planning, and joint requirements, and to ensure through col- 
laborative, inclusive senior leadership dialogue and decision that they function in 
a way that considers DHS-wide missions and functions, rather than focusing on 
those of an individual component. 

As an example, I am leading the Deputies Management Action Group in an expe- 
dited review to provide strategic alternatives for enhancing the current DHS joint 
requirements process. This review will include options for developing and facili- 
tating a DHS component-driven, joint requirements process, including a program for 
oversight of a development test and evaluation capability, to identify priority gaps 
and overlaps in Departmental capability needs, provide feasible technical alter- 
natives to meet capability needs, and recommend to me the creation of joint pro- 
grams and joint acquisitions to meet Department-wide mission needs. This en- 
hanced process will be used in expanding the mission portfolios studied in the 
IILCM pilot, which included Cybersecurity, Biodefense, and Screening and Vetting, 
to include Border Security and Air Domain. 

DHS recently announced two important decisions that speak to our commitment 
to responsible and cost-effective acquisitions. First, DHS cancelled the BioWatch ac- 
quisition of autonomous detection technology (also known as Gen-3). Currently de- 
ployed in more than 30 metropolitan areas across the country, BioWatch provides 
public health officials with a warning of a biological agent release before potentially 
exposed individuals develop symptoms of illness. While autonomous detection is an 
important capability, the Gen-3 acquisition did not reflect the best use of resources 
in our current fiscal environment. DHS remains committed to the BioWatch pro- 
gram and will ensure that current BioWatch operations continue as part of our lay- 
ered approach to biodefense. Second, DHS is putting on hold a FEMA Logistics Sup- 
ply Chain Management System contract until further review. FEMA’s Logistics Sup- 
ply Chain Management System was developed to provide full disaster supply chain 
management capability and visibility to FEMA and its partners. The Department 
has determined that the program has not met all of its operational requirements 
and that it needs to be reviewed in the context of broader logistical operations. That 
review is underway, which will include a third-party evaluation of the most cost- 
effective manner. These decisions are in line with the Department’s focus on effi- 
ciency, ensuring that we continue to pursue cost-effective acquisition without com- 
promising our security. The Secretary and I will continue to hold our acquisition 
programs accountable to ensure they are responsible and cost-effective. 

Additionally, the DHS Chief Financial Officer has strengthened and enhanced the 
Department’s programming and budgeting process by incorporating the results of 
strategic analysis and joint requirements planning into portfolios for review by issue 
teams. Using this approach, substantive, large-scale alternative choices will be pre- 
sented to the Deputies Management Action Group as part of the annual budget de- 
velopment. This review process will also include the Department’s existing pro- 
grammatic and budgetary structure, not just new investments. It will include the 
ability for DHS to project the impact of current decisions on resource issues such 
as staffing, capital acquisitions, operations and maintenance, and similar issues that 
impact the Department’s future ability to fulfill its mission responsibilities. As its 
first task, the Deputies Management Action Group will focus this enhanced pro- 
gramming and budgeting process on the development of options for the fiscal year 
2016 budget request. 

In the oversight phase, we will continue to leverage the Component Acquisition 
Executive structure and enhanced business intelligence to proactively identify per- 
formance problems with existing programs throughout their life cycle. While there 
is work to be done to sustain our progress, we are encouraged by an Office of the 
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Inspector General report that stated that DHS has significantly strengthened our 
acquisition management oversight. 

We have also made significant progress in strengthening the document review 
process. In 2013, the under secretary for management issued a decision memo- 
randum stating that no new program can proceed without the approved acquisition 
documentation, including life-cycle cost estimates, mission needs statements, test 
and evaluation plans, and operational requirements documents. 

To ensure we have an adequately staffed and trained acquisition workforce, the 
Department has engaged on multiple fronts to enhance acquisition staffing and 
training. The DHS Acquisition Professional Career Program (APCP) is sponsored by 
the chief procurement officer and provides a steady pipeline of entry-level con- 
tracting and procurement talent to the components. APCP interns are hired into ca- 
reer ladder positions and engage in a 3-year program where they receive quality 
training and rotate between components to gain valuable on-the-job training. In fis- 
cal year 2013 alone, 63 interns graduated and have been placed in components. 
Thus far in fiscal year 2014, an additional 60 interns have been placed. 

The Department’s Homeland Security Acquisition Institute continues to serve as 
the principal training academy for the DHS acquisition workforce. In fiscal year 
2013, over 9,400 DHS acquisition professionals completed classroom or on-line train- 
ing courses contributing to the issuance of over 3,200 acquisition certifications. Thus 
far in fiscal year 2014, an additional 1,300 acquisition certifications have been 
issued. To date, DHS has issued 10,732 certifications across nine acquisition dis- 
ciplines, including Contracting, Program Management, Systems Engineering, Test 
and Evaluation, Cost Estimating, Life Cycle Logistics Management, Program Finan- 
cial Management, Ordering Official, and Contracting Officer’s Representative. 

DHS continues to support small businesses around the country. In recognition of 
its performance, the Department has received an “A” rating for 5 consecutive years 
from the Small Business Administration in the areas of prime contracting, small 
business subcontracting, and a written progress plan. 

Information Technology Management 

In the Information Technology (IT) area, DHS has made substantial progress to 
drive efficiencies through consolidation of data centers. To date, 18 primary data 
centers have been consolidated, with an additional two consolidations scheduled for 
completion in fiscal year 2014. Migrations from commercial data centers resulted in 
annual cost savings of 43%, and migrations from Federal data centers resulted in 
an average annual cost savings of 12% for similar capabilities. 

Recognizing that information technology is constantly improving and changing 
and that our own IT organization has matured, we are working to increase the inte- 
gration of previously fragmented Departmental oversight reviews into a defined, ef- 
ficient governance process that is tailored to the size and criticality of each program. 
This will result in improved project tracking and oversight and will also help DHS 
meet our IT-related mission needs. 

Security of internal IT systems and networks also remains a priority. DHS con- 
tinues to enhance the IT security of the Department’s internal systems and net- 
works through periodic upgrades to software. In addition, IT staff performs inde- 
pendent validation and verification of implemented corrective actions to address ma- 
terial weaknesses related to financial systems security. All components are imple- 
menting a desktop image based on the United States Government Configuration 
Baseline (USGCB) settings. 

Management Integration 

Management Integration refers to the development and implementation of con- 
sistent and consolidated processes within and across the management functional 
areas discussed above. From individual performance evaluations to the Depart- 
ment’s most costly investment decisions, we have the obligation to operate efficiently 
and in a manner that best enables us to meet our mission. 

The Management Integration area has made substantial progress in the past 3 
years, reflected by the fact that both DHS and GAO agree that the majority of the 
outcomes in the Management Integration area are fully addressed. DHS has made 
considerable progress towards integrating management across the enterprise. As an 
example, we have strengthened the delegations of authority to clarify the roles of 
and enhance oversight between Headquarters and components, and we have imple- 
mented the pilot phase of the IILCM to ensure we base investment decisions on 
closing capability gaps and meeting mission goals and outcomes. Based on the les- 
sons learned from the pilot, the Secretary has determined, through the Unity of Ef- 
fort initiative, to focus immediate attention on further maturing the Strategy and 
Capabilities & Requirements phases. 
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Secretary Johnson and I are committed to integrating all phases of our invest- 
ment life cycle as we prepare for the fiscal year 2016 budget submission. Advancing 
the IILCM framework, which is a principal tenet of the Department’s overall inte- 
gration strategy, continues to be a major initiative that builds on the progress we 
have made. In the near future, as I referenced above, I will oversee a re-constituted 
Joint Requirements Council as we evaluate fiscal year 2016 resource allocation 
plans and attempt to harmonize and unify requirements across the DHS enterprise. 

The Secretary and I are capitalizing on these previous efforts and broadening 
them in our “Strengthening Departmental Unity of Effort” initiative. This effort fo- 
cuses on improving our planning, programming, budgeting, and execution processes 
through strengthened Departmental structures and increased capability. In making 
these changes, we will have better traceability between strategic objectives, budg- 
eting, acquisition decisions, operational planning, and mission execution to improve 
Departmental cohesiveness and operational effectiveness. 

We are in the final stages of evolving our business intelligence capability by con- 
solidating management data systems onto a common platform. This effort allows for 
more current and integrated data across all lines of business, both at headquarters 
and into DHS’s many components. 

OTHER DHS HIGH-RISK LIST AREAS 

We recognize the critical role that strengthened management functions have in 
the Department’s ability to achieve success. GAO has identified other areas of De- 
partment responsibilities that also play an integral role in our mission delivery and, 
while these non-management areas are not the focus of this hearing, I hope it will 
be beneficial to this committee for me to provide a brief overview of our work in 
a few of these areas. 

Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related In- 
formation to Protect the Homeland 

DHS is a key participant in the Federal Information Sharing Environment and 
continues to develop policies and technical solutions across Sensitive but Unclassi- 
fied, Secret, and Top Secret/Sensitive Compartmented Information networks that 
enhance safeguarding and sharing of information with a wide variety of Federal, 
State, local, and private-sector stakeholders. In January 2013 and immediately fol- 
lowing the release of the National Strategy for Information Sharing and Safe- 
guarding, the Department issued the DHS Information Sharing and Safeguarding 
Strategy focused on goals to share, safeguard, manage, and govern risk, and meas- 
ure performance. Through a detailed Implementation Plan, the Department has 
identified key priority objectives with synchronized milestones to effectively execute 
the Strategy, and has prepared an Implementation Guide that defines the processes 
to identify gaps, root causes, performance measures, risks, and resourcing for its top 
information-sharing and safeguarding initiatives. 

National Flood Insurance Program 

The National Flood Insurance Program (NFIP) serves as the foundation for Na- 
tional efforts to reduce the loss of life and property from flood disasters. NFIP re- 
mains on the High-Risk List largely because it does not generate sufficient revenues 
to repay the billions of dollars borrowed from the U.S. Department of the Treasury 
to cover claims from the 2005 and 2012 hurricanes or from future catastrophic 
losses. The lack of sufficient revenues has highlighted structural weaknesses in how 
the program is funded, including statutorily-mandated subsidies. 

DHS and FEMA have been working with GAO to address the challenges identified 
in GAO’s recommendations to improve management and operations. FEMA changed 
the process for Write Your Own (WYO) company performance under the WYO Fi- 
nancial Control plan, implemented procedures to select statistically representative 
samples of all claims for conducting claims re-inspections, and requested an inde- 
pendent audit of the NFIP’s financial statements. FEMA’s focus on implementing 
GAO recommendations in areas including Strategic Planning, Management and 
Oversight of the NFIP, and modernizing the NFIP IT system, have resulted in the 
closure of many of GAO’s recommendations. We are actively engaged on those GAO 
recommendations that remain open. 

With the passage of the Biggert-Waters Flood Insurance Act of 2012 and the 
Homeowners Flood Insurance Affordability Act of 2014, the NFIP now has authority 
to phase in actuarial rates for some policies and charge policyholders a surcharge, 
which will improve the financial and operational position of the program over time; 
however, as a result, policyholders will not pay actuarial rates. Specifically, these 
two laws raise the statutory limit on annual rate increases, mandate premium in- 
creases for certain subsidized policies, establish a reserve fund that will allow the 
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NFIP to build surplus capital to pay losses in a greater-than-average loss year, and 
mandate a $25 annual surcharge for most policyholders and a $250 annual sur- 
charge for non-residential properties and residential properties that are not a pri- 
mary residence, until actuarial rates are reached. 

Protecting the Federal Government’s Information Systems and the Nation’s Cyber 
Critical Infrastructures 

I appreciate GAO’s continued engagement on Federal agency cyhersecurity and 
the cybersecurity of critical infrastructure. Since 2009, the Department has man- 
aged this area actively, and each subsequent update to the GAO High-Risk List has 
recognized DHS efforts. The Department works closely with the White House and 
interagency partners to ensure a whole-of-Government approach to cybersecurity. At 
the same time, DHS is committed to working with Congress as it explores legisla- 
tive proposals. 

DHS directly supports Federal civilian departments and agencies in developing 
capabilities that will improve their own cybersecurity posture through the Contin- 
uous Diagnostics and Mitigation (CDM) program. One hundred eight departments 
and agencies are currently covered by Memoranda of Agreement with the CDM pro- 
gram, encompassing over 97 percent of all Federal civilian personnel. In fiscal year 
2014, DHS issued the first delivery order for CDM sensors and awarded a contract 
for the CDM dashboard. 

The National Cybersecurity Protection System (NCPS), a key component of which 
is referred to as EINSTEIN, is an integrated intrusion detection, analytics, informa- 
tion sharing, and intrusion-prevention system designed to support DHS responsibil- 
ities for protecting Federal civilian agency networks. These current capabilities, and 
future capabilities such as CDM, are used by the Department’s National Cybersecu- 
rity and Communications Integration Center, in concert with its analysis, warning, 
and incident response capabilities, to protect Federal civilian agencies and assist 
them when incidents occur. In July 2013, NCPS’s EINSTEIN 3 Accelerated (E3A) 
became operational and provided services to the first Federal agency. With the 
adoption of E3A, DHS will assume an active role in defending .gov network traffic 
and significantly reduce the threat vectors available to malicious actors seeking to 
harm Federal networks. NCPS continues to expand intrusion prevention, informa- 
tion sharing, and cyher analytic capabilities at Federal agencies, marking a critical 
shift from a passive to an active role in cyber defense and the delivery of enterprise 
cybersecurity services to decision makers across cybersecurity communities. 

With respect to critical infrastructure, the Department continues to grow the crit- 
ical infrastructure Cyber Information Sharing and Collaboration Program, which is 
a unique voluntary environment for public-private information sharing and collabo- 
ration. In addition, we recently launched the Critical Infrastructure Cyber Commu- 
nity or C3 (“C Cubed”) Voluntary Program to assist critical infrastructure owners 
and operators as they huild cybersecurity into their risk management approaches. 
Much work remains to be completed and we are committed to actively managing 
this High-Risk area. 

When I met with Comptroller General Dodaro, we agreed to develop a set of de- 
tailed criteria that GAO and the Department can use to strengthen the Nation’s cy- 
bersecurity and critical infrastructure resilience. As part of that process, I will re- 
ceive monthly status updates from DHS components that we will share with GAO. 

CONCLUSION 

It is our fundamental responsibility to manage the Department of Homeland Se- 
curity effectively and efficiently. Sound management is critical to our ability to exe- 
cute our mission successfully, and it is incumbent upon us as guardians of the pub- 
lic trust to be careful and scrupulous in our expenditure of public funds. You have 
my commitment that I will continue to focus intensely on strengthening the Depart- 
ment’s management functions, and that I will work closely with this committee and 
with GAO to achieve that goal. 

Thank you for the opportunity and the privilege to appear before you. 

Chairman McCaul. Thank you, Deputy Secretary. The Chair- 
man now recognizes Mr. Dodaro for an opening statement. 
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STATEMENT OF GENE L. DODARO, COMPTROLLER GENERAL 

OF THE UNITED STATES, GOVERNMENT ACCOUNTABILITY 

OFFICE 

Mr. Dodaro. Thank you very much, Mr. Chairman. Good morn- 
ing to you, Ranking Member Thompson, distinguished Members of 
the committee. I appreciate the opportunity to be here today to dis- 
cuss GAO’s designations and high-risk areas regarding the Depart- 
ment of Homeland Security. 

With regard to the management functions that we initially 
placed on the list in 2003, I am pleased to report that the Depart- 
ment is well on its way to satisfying two of the five criteria for com- 
ing off the list. 

One is leadership commitment, and I am very satisfied with the 
deputy secretary and the Secretary’s engagement on this issue. I 
believe that we have an open, constructive dialogue, which is the 
first step toward resolving some of these problems. 

They also have a pretty good integrated plan for coming off the 
high-risk list. However, they still need to demonstrate the capacity 
to make the changes, to have a monitoring effort to make sure that 
the changes are implemented properly. Most importantly and lastly 
is they need to demonstrate progress in making sure that they 
have actually fixed some of the underlying problems that have 
plagued them in the past. 

With regard to the acquisition area, for example, they have des- 
ignated acquisition components at the component level and orga- 
nized some centers to bring together some core expertise to help in 
the acquisitions area. But they need to have governance mecha- 
nisms in place to look at the entire acquisition portfolio and set pri- 
orities across the Department. Then to make sure that individual 
acquisitions operate effectively and are more consistently meeting 
the Department’s policies. 

For example, 46 percent of the major acquisitions do not have ap- 
proved baseline cost. About 77 percent do not have yet approved 
life-cycle cost estimates. So I believe the H.R. 4228 that this com- 
mittee passed is a very important contribution step forward to put- 
ting disciplined acquisition policies in place and having more trans- 
parency and accountability for the Department. 

With regard to financial management, they have received the 
clean opinion that both the Chairman and Ranking Member recog- 
nized this morning for fiscal year 2013 financial statements. How- 
ever, to meet our list to get off the list they need to sustain the 
clean opinion. 

They need to get a clean opinion on internal controls, which they 
are not able to do at this point because of a number of material 
weaknesses in their systems. They also need to effectively put in 
modern financial management systems in the components, particu- 
larly the Coast Guard, FEMA, ICE, and Customs and Border Pa- 
trol. 

With regard to human capital management they have put to- 
gether a plan to guide them in this area. But they must address 
the root causes that are at the heart of the employee morale issues 
that have plagued the Department for a number of years. Also to 
focus on processes to identify skill gaps and to remedy those skill 
gaps across the Department. 
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In the IT area we are pleased they have had an enterprise archi- 
tecture in place, which is a good first step. But they need to finalize 
their policy governance structure for IT investments, and to expand 
that policy to cover all 13 portfolios. Right now they have it only 
covering five of 13. They need to fix their information security 
weaknesses, which are a major control problem for the Depart- 
ment. 

Now with regard to other areas we have on the high-risk list — 
cybersecurity and critical infrastructure protection that DHS is 
part of. National Flood Insurance Program, and information shar- 
ing in the terrorist information sharing — I would be happy to an- 
swer any questions on those areas at the appropriate time. 

I would just say with regard to cybersecurity there has been a 
lot of attention to this area, but more needs to be done. I am very 
supportive of the H.R. 3696 legislation that you have initiated. 

I think the Department has been given responsibility for cyberse- 
curity across the Federal Government without the authority. That 
authority should be codified and put into law. Also giving them ad- 
ditional guidance in the critical infrastructure protection area and 
additional codification is a really good step forward. 

So I commend this committee toth for the acquisition legislation 
and the cybersecurity and critical infrastructure legislation. So, I 
would be happy to answer questions at the appropriate point in 
time. I again very much appreciate the opportunity to be here 
today to discuss our efforts to help the Department reach its full 
potential. 

[The prepared statement of Mr. Dodaro follows:] 

Prepared Statement of Gene L. Dodaro 
May 7, 2014 

Chairman McCaul, Ranking Member Thompson, and Members of the committee: 
I am pleased to be here today to discuss our work on the Department of Homeland 
Security’s (DHS) on-going efforts to improve the efficiency of its operations and 
unity of the Department, with a particular focus on DHS’s progress and remaining 
challenges addressing GAO’s high-risk designations. In the 11 years since the De- 
partment’s creation, DHS has implemented key homeland security operations, 
achieved important goals and milestones, and grown to more than 240,000 employ- 
ees and approximately $60 billion in budget authority. During that time, our work 
has identified several areas where DHS needs to address gaps and weaknesses in 
its current operational and implementation efforts, as well as strengthen the effi- 
ciency and effectiveness of those efforts. Since 2003, we have made approximately 
2,100 recommendations to DHS to strengthen program management, performance 
measurement efforts, and management processes, among other things. DHS has im- 
plemented more than 65 percent of these recommendations and has actions under 
way to address others. 

We also report regularly to the Congress on Government operations that we iden- 
tified as high-risk because of their greater vulnerability to fraud, waste, abuse, and 
mismanagement, or the need for transformation to address economy, efficiency, or 
effectiveness challenges. DHS has sole or critical responsibility for four GAO high- 
risk areas — (1) Strengthening DHS Management Functions, (2) National Flood In- 
surance Program (NFIP), (3) Protecting the Federal Government’s Information Sys- 
tems and the Nation’s Cyber Critieal Infrastructures, and (4) Establishing Effective 
Mechanisms for Sharing and Managing Terrorism-Related Information to Protect the 
Homeland. DHS has made progress addressing areas we have identified as high- 
risk, but needs to continue to strengthen its efforts in order to more efficiently and 
effectively achieve its homeland security missions. In particular: 

• In 2003, we designated implementing and transforming DHS as high-risk be- 
cause DHS had to transform 22 agencies — several with major management 
challenges — into one department, and failure to address associated risks could 
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have serious consequences for U.S. National and economic security.^ While chal- 
lenges remain across its missions, DHS has made considerable progress in 
transforming its original component agencies into a single department. As a re- 
sult, in our 2013 high-risk update, we narrowed the scope of the high-risk area 
to focus on strengthening DHS management functions (human capital, acquisi- 
tion, financial management, and information technology [IT]).^ 

• In 2006, we added the NFIP — a key component of the Federal Government’s ef- 
forts to limit the damage and financial impact of floods — to the GAO high-risk 
list because the program faced significant on-going financial and management 
challenges.^ In particular, the NFIP, which is managed by DHS’s Federal Emer- 
gency Management Agency (FEMA), is unlikely to generate sufficient revenue 
to cover future catastrophic losses or repay billions of dollars borrowed from the 
Department of the Treasury to cover insurance claims from previous disasters. 

• In 1997, we designated Federal information security as a Government-wide 
high-risk area, and we expanded the area in 2003 to include systems supporting 
critical infrastructure such as power distribution, communications, banking and 
finance, water supply, National defense, and emergency services.^ The effective 
security of these systems and the data they contain is essential to National se- 
curity, economic well-being, and public health and safety. DHS is responsible 
for securing its own information systems and data and also plays a pivotal role 
in Government-wide cybersecurity efforts. 

• In 2005, we designated the sharing of terrorism-related information as high-risk 
because of the significant challenges the Federal Government faces in sharing 
this information in a timely, accurate, and useful manner.® The sharing of ter- 
rorism-related information is a Government-wide effort that involves numerous 
Federal departments and agencies. DHS plays a critical role in this sharing 
given its homeland security missions and responsibilities. 

In November 2000, we published our criteria for removing areas from the high- 
risk list.® Specifically, agencies must have (1) a demonstrated strong commitment 
and top leadership support to address the risks; (2) a corrective action plan that 
identifies the root causes, identifies effective solutions, and provides for substan- 
tially completing corrective measures in the near term, including but not limited to 
steps necessary to implement solutions we recommended; (3) the capacity (that is, 
the people and other resources) to resolve the risks; (4) a program instituted to mon- 
itor and independently validate the effectiveness and sustainability of corrective 
measures; and (5) the ability to demonstrate progress in implementing corrective 
measures. When legislative, administration, and agency actions, including those in 
response to our recommendations, result in significant progress toward resolving a 
high-risk problem, we remove the high-risk area. 

My testimony today discusses our observations on DHS’s progress and work re- 
maining in addressing: (1) High-risk areas for which DHS has sole responsibility, 
and (2) high-risk areas for which DHS has critical, but shared, responsibility. 

This statement is based on GAO’s 2013 high-risk update as well as reports and 
testimonies we issued from March 2013 through April 2014.^ For the past products, 
among other things, we analyzed DHS strategies and other documents related to the 
Department’s efforts to address its high-risk areas; reviewed our past reports issued 
since DHS began its operations in March 2003; and interviewed DHS officials. More 
detailed information on the scope and methodology of our prior work can be found 
within each specific report. This statement is also based on analyses from our on- 
going assessment of DHS’s efforts to address its high-risk areas since February 
2013. We expect to report final results from this work in our 2015 high-risk update. 
For our analyses, among other things, we analyzed DHS documentation, such as De- 
partmental guidance, and met with DHS officials, including the deputy secretary 
and under secretary for management, to discuss DHS’s efforts to address its high- 
risk areas. With respect to the Strengthening DHS Management Functions high-risk 
area, on May 1, 2014, DHS provided us with an updated version of its Integrated 


^GAO, High-Risk Series: An Update, GAO— 03-119 (Washington, DC: January 2003). 

2 GAO, High-Risk Series: An Update, GAO-13—283 (Washington, DC: February 2013). For ad- 
ditional information, see our high-risk list key issues page at http: i t wivw.gao.gov I highriskj 
overview. 

3 GAO, GAO’s High-Risk Program, GAO-06-497T (Washington, DC: Mar. 15, 2006). 
'‘GAO-03-119. 

®GAO, High-Risk Series: An Update, GAO— 05-207 (Washington, DC: Jan. 1, 2005). 

®GAO, Determining Performance and Accountability Challenges and High Risks, GAO-01— 
159SP (Washington, DC: Nov. 1, 2000). 

''GAO-13-283. 
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Strategy for High-Risk Management. We plan to analyze this update as part of our 
on-going assessment of DHS’s progress in addressing this high-risk area. 

We conducted the work on which this statement is based in accordance with gen- 
erally accepted Government auditing standards. Those standards require that we 
plan and perform the audit to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based on our audit objectives. We 
believe that the evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 

HIGH-RISK AREAS FOR WHICH DHS HAS SOLE RESPONSIBILITY 

DHS has made progress in addressing high-risk areas for which it has sole re- 
sponsibility, but significant work remains. 

Strengthening DHS Management Functions 

DHS has made important progress in implementing, transforming, strengthening, 
and integrating its management functions in human capital, acquisition, financial 
management, and IT. This has included taking numerous actions specifically de- 
signed to address our criteria for removing areas from the high-risk list. However, 
as we reported in our February 2013 high-risk update, this area remains high-risk 
because the Department has significant work ahead.® As shown in Table 1, DHS 
has met two of our criteria for removal from the high-risk list (leadership commit- 
ment and a corrective action plan), and has partially met the remaining three cri- 
teria (a framework to monitor progress; capacity; and demonstrated, sustained 
progress). 

TABLE 1.— ASSESSMENT OF DEPARTMENT OF HOMELAND SECURITY (DHS) 
PROGRESS IN ADDRESSING THE STRENGTHENING DHS MANAGEMENT 
FUNCTIONS HIGH-RISK AREA, AS OF MAY 2014 


Criterion for Removal From the High-Risk List 


Met^ 


Not 

Met® 


Leadership commitment X 

Corrective action plan X 

Capacity X 

Framework to monitor progress X 

Demonstrated, sustained progress X 


Total 2 3 0 


Source: GAO analysis of DHS documents, interviews, and prior GAO reports. 

®“Met”: There are no significant actions that need to be taken to further address this cri- 
terion. 

® “Partially met”: Some but not all actions necessary to generally meet the criterion have 
been taken. 

® “Not met”: Few, if any, actions toward meeting the criterion have been taken. 

Leadership commitment (met). — The Secretary and deputy secretary of Home- 
land Security, the under secretary for management at DHS, and other senior offi- 
cials have continued to demonstrate commitment and top leadership support for ad- 
dressing the Department’s management challenges. They have also taken actions to 
institutionalize this commitment to help ensure the long-term success of the Depart- 
ment’s efforts. For example, in May 2012, the Secretary of Homeland Security modi- 
fied the delegations of authority between the Management Directorate and its coun- 
terparts at the component level to clarify and strengthen the authorities of the 
under secretary for management across the Department. 

In addition, in April 2014, the Secretary of Homeland Security issued a memo- 
randum committing to improving DHS’s planning, programming, budgeting, and 
execution processes through strengthened Departmental structures and increased 
capability. This memorandum identified several initial areas of focus intended to 
build organizational capacity.® Senior DHS officials have also routinely met with us 
over the past 5 years to discuss the Department’s plans and progress in addressing 
this high-risk area, during which we provided specific feedback on the Department’s 
efforts. According to these officials, and as demonstrated through their progress, the 
Department is committed to demonstrating measurable, sustained progress in ad- 


s GAO-13-283. 

® DHS, Secretary of Homeland Security, Strengthening Departmental Unity of Effort, Memo- 
randum for DHS Leadership (Washington, DC: April 22, 2014). 
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dressing this high-risk area. It will be important for DHS to maintain its current 
level of top leadership support and sustained commitment to ensure continued 
progress in successfully executing its corrective actions through completion. 

Corrective action plan (met). — DHS established a plan for addressing this 
high-risk area. In a September 2010 letter to DHS, we identified and DHS agreed 
to achieve 31 actions and outcomes that are critical to addressing the challenges 
within the Department’s management areas and in integrating those functions 
across the Department. In January 2011, DHS issued its initial Integrated Strategy 
for High-Risk Management, which included key management initiatives and related 
corrective action plans for addressing its management challenges and the outcomes 
we identified. DHS provided updates of its progress in implementing these initia- 
tives and corrective actions in its later versions of the strategy. In March 2014, we 
made updates to the actions and outcomes in collaboration with DHS to reduce over- 
lap and ensure their continued relevance and appropriateness. These updates re- 
sulted in a reduction from 31 to 30 total actions and outcomes. 

DHS’s strategy and approach to continuously refining actionable steps to imple- 
menting the outcomes, if implemented effectively and sustained, provide a path for 
DHS to be removed from GAO’s high-risk list. 

Capacity (partially met). — In May 2014, DHS identified that it had resources 
needed to implement 7 of the 11 initiatives the Department had under way to ad- 
dress the actions and outcomes, but did not identify sufficient resource needs for the 
4 remaining initiatives. In our analysis of DHS’s June 2013 update, which similarly 
did not identify sufficient resource needs for all initiatives, we found that this ab- 
sence of complete resource information made it difficult to fully assess the extent 
to which DHS has the capacity to implement its initiatives. 

In addition, our prior work has identified specific capacity gaps that could under- 
mine achievement of management outcomes. For example, in September 2012, we 
reported that 51 of 62 acquisition programs faced workforce shortfalls in program 
management, cost estimating, engineering, and other areas, increasing the likeli- 
hood that the programs will perform poorly in the future. Since that time, DHS 
has appointed component acquisition executives at the components and made 
progress in filling staff positions. In April 2014, however, we reported that DHS 
needed to increase its cost-estimating capacity, and that the Department had not 
approved baselines for 21 of 46 major acquisition programs. These baselines — 
which establish cost, schedule, and capability parameters — are necessary to accu- 
rately assess program performance. 

DHS needs to continue to identify resources for the remaining initiatives; deter- 
mine that sufficient resources and staff are committed to initiatives; work to miti- 
gate shortfalls and prioritize initiatives, as needed; and communicate to senior lead- 
ership critical resource gaps. 

Framework to monitor progress (partially met). — DHS established a frame- 
work for monitoring its progress in implementing the corrective actions it identified 
for addressing the 30 actions and outcomes. In the June 2012 update to the Inte- 
grated Strategy for High-Risk Management, DHS included, for the first time, per- 
formance measures to track its progress in implementing all of its key management 
initiatives. DHS continued to include performance measures in its May 2014 update. 

Additionally, in March 2014, the deputy secretary began meeting monthly with 
the DHS management team to discuss DHS’s progress in strengthening its manage- 
ment functions. According to senior DHS officials, as part of these meetings, 
attendees discuss a report that senior DHS officials update each month, which iden- 
tifies corrective actions for each outcome, as well as projected and actual completion 
dates. 

However, there are opportunities for DHS to strengthen this framework. For ex- 
ample, as we reported in September 2013, DHS components need to develop per- 
formance and functionality targets for assessing their proposed financial systems. 
This would include having an independent validation and verification program in 
place to ensure the modernized financial systems meet expected targets. Moving for- 
ward, DHS will need to closely track and independently validate the effectiveness 


i*’ GAO, Homeland Security: DHS Requires More Disciplined Investment Management to Help 
Meet Mission Needs, GAO— 12-833 (Washington, DC: Sept. 18, 2012). 

^^GAO, Homeland Security Acquisitions: DHS Could Better Manage Its Portfolio to Address 
Funding Gaps and Improve Communications with Congress, GAO-14-332 (Washington, DC: 
Apr. 17, 2014). 

GAO, DHS Financial Management: Additional Efforts Needed to Resolve Deficiencies in In- 
ternal Controls and Financial Management Systems, GAO— 13— 561 (Washington, DC: Sept. 30, 
2013). 
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and sustainability of its corrective actions and make mid-course adjustments, as 
needed. 

Demonstrated, sustained progress (partially met). — Key to addressing the 
Department’s management challenges is DHS demonstrating the ability to achieve 
sustained progress across the 30 actions and outcomes we identified and DHS 
agreed were needed to address the high-risk area. These actions and outcomes in- 
clude, among others, validating required acquisition documents in accordance with 
a Department-approved, knowledge-based acquisition process, and sustaining clean 
audit opinions for at least 2 consecutive years on Department-wide financial state- 
ments and internal controls. As illustrated by the examples below, DHS has made 
important progress in implementing corrective actions across its management func- 
tions, but it has not demonstrated sustainable, measurable progress in addressing 
key challenges that remain within these functions and in the integration of those 
functions.^® 

Human capital management . — DHS has mostly addressed 1 of the 7 human cap- 
ital management outcomes and partially addressed the remaining 6. For example, 
as we reported in December 2012, DHS has developed and demonstrated progress 
in implementing a strategic human capital plan.i'^ This plan, among other things, 
is integrated with broader organizational strategic planning, and mostly addresses 
this outcome. However, DHS needs to improve other aspects of its human capital 
management. 

• As we reported in December 2013, the Office of Personnel Management’s 2013 
Federal Employee Viewpoint Survey data showed that DHS employee satisfac- 
tion was 36th of 37 Federal agencies and had decreased 7 percentage points 
since 2011, which is more than the Government- wide decrease of 4 percentage 
points over the same time period, As a result, the gap between average DHS 
employee satisfaction and the Government-wide average widened to 7 percent- 
age points. Accordingly, DHS has considerable work ahead to improve its em- 
ployee morale. 

• Further, according to senior DHS officials, the Department has efforts under 
way intended to link workforce planning efforts to strategic and program-spe- 
cific planning efforts to identify current and future human capital needs, includ- 
ing the knowledge, skills, and abilities needed for the Department to meet its 
goals and objectives. According to these officials, the Department is in the proc- 
ess of finalizing competency gap assessments to identify potential skills gaps 
within its components that collectively encompass almost half of the Depart- 
ment’s workforce. These assessments focus on occupations DHS identifies as 
critical to its mission, including emergency management specialists and cyber- 
focused IT management personnel. DHS plans to analyze the results of these 
assessments and develop plans to address any gaps the assessments identify by 
the end of fiscal year 2014. This is a positive step, as identifying skills gaps 
could help the Department to better identify current and future human capital 
needs and ensure the Department possesses the knowledge, skills, and abilities 
needed to meet its goals and objectives. Given that DHS is finalizing these as- 
sessments, it is too early to assess their effectiveness. 

Acquisition management . — DHS has mostly addressed one of the five acquisition 
management outcomes, partially addressed one, and initiated activities to address 
the remaining three. DHS has made the most progress in increasing component- 
level acquisition capability by, for example, establishing a component acquisition ex- 
ecutive in each DHS component to provide oversight and support programs within 
its portfolio. DHS has also taken steps to enhance its acquisition workforce by estab- 
lishing centers of excellence for cost estimating, systems engineering, and other dis- 
ciplines to promote best practices and provide technical guidance. However, DHS 
needs to improve its acquisition management. For example: 

• DHS initiated a governance body in 2013 to review and validate acquisition pro- 
grams’ requirements and identify and eliminate any unintended redundancies, 
but it considered trade-offs only across acquisition programs within the Depart- 


For our assessments of DHS’s progress in addressing the 30 outcomes, “fully addressed” 
means the outcome is fully addressed; “mostly addressed” means progress is significant and a 
small amount of work remains; “partially addressed” means progress is measurable, but signifi- 
cant work remains; and “initiated” means activities have been initiated to address outcomes, but 
it is too early to report progress. 

11 GAO, DHS Strategic Workforce Planning: Oversight of Department-wide Efforts Should Be 
Strengthened, GAO— 13-65 (Washin^on, DC: Dec. 3, 2012). For example: 

i®The Federal Employee Viewpoint Survey measures employees’ perceptions of whether and 
to what extent conditions characterizing successful organizations are present in their agencies. 

13 GAO, Department of Homeland Security: DHS’s Efforts to Improve Employee Morale and 
Fill Senior Leadership Vacancies, GAO-14— 228T (Washington, DC: Dec. 12, 2013). 
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merit’s cybersecurity portfolio. DHS acknowledged that the Department has no 
formal structure in place to consider trade-offs DHS-wide, hut DHS anticipates 
chartering such a hody by the end of May 2014. 

• DHS also has initiated efforts to validate required acquisition documents in ac- 
cordance with a knowledge-based acquisition process, but this remains a major 
challenge for the Department. A knowledge-hased approach provides developers 
with information needed to make sound investment decisions, and it would help 
DHS address significant challenges we have identified across its acquisition pro- 
grams. DHS’s acquisition policy largely reflects key acquisition management 
practices, hut the Department has not implemented it consistently. In March 
2014, we reported that the Transportation Security Administration does not col- 
lect or analyze available information that could be used to enhance the effec- 
tiveness of its advanced imaging technology.'^® In March 2014, we also found 
that U.S. Customs and Border Protection (CBP) did not fully follow DHS policy 
regarding testing for the integrated fixed towers being deployed on the Arizona 
border.'® As a result, DHS does not have complete information on how the tow- 
ers will operate once they are fully deployed. 

• Finally, DHS does not have the acquisition management tools in place to con- 
sistently demonstrate whether its major acquisition programs are on track to 
achieve their cost, schedule, and capability goals. About half of major programs 
lack an approved baseline, and 77 percent lack approved life-cycle cost esti- 
mates. DHS stated in its 2014 update that it will take time to demonstrate sub- 
stantive progress in this area. We have recently initiated two reviews to exam- 
ine DHS's progress in these high-risk areas. In addition, the House Homeland 
Security committee recently introduced a DHS acquisition reform bill that rein- 
forces the importance of key acquisition management practices, such as estab- 
lishing cost, schedule, and capability parameters, and includes requirements to 
better identify and address poor-performing acquisition programs, which could 
aid the Department in addressing its acquisition management challenges. 

Financial management . — DHS has made process toward improving its financial 
management and has fully addressed 1 of 8 high-risk financial management out- 
comes — ensuring its financial statements are accurate and reliable.^® However, a 
significant amount of work remains to be completed on the other 7 outcomes related 
to DHS’s financial statements, internal control over financial reporting, and modern- 
izing financial management systems. 

• DHS produced accurate and reliable financial statements for the first time in 
fiscal year 2013, in part through management’s commitment to improving its 
financial management process. As of May 2014, DHS is working toward sus- 
taining this key achievement. 

• DHS Has also made some progress toward implementing effective internal con- 
trol over financial reporting, in part by implementing a corrective action plan- 
ning process aimed at addressing internal control weaknesses. For example, the 
Department took corrective actions to reduce the material weakness in environ- 
mental and other liabilities to a significant deficiency.^' However, DHS needs 
to eliminate all material weaknesses at the Department level before its finan- 
cial auditor can assert that the controls are effective. For example, one of the 
material weaknesses involves deficiencies in property, plant, and equipment. 
DHS plans to achieve this outcome for fiscal year 2016. To meet another out- 
come, DHS needs to sustain these efforts for 2 years. 

• DHS also needs to effectively manage the modernization of financial manage- 
ment systems at the U.S. Coast Guard (USCG), U.S. Immigration and Customs 


"In our past work examining weapon acquisition issues and best practices for product devel- 
opment, we have found that leading commercial firms pursue an acquisition approach that is 
anchored in knowledge, whereby high levels of product knowledge are demonstrated by critical 
points in the acquisition process. 

'®GAO, Advanced Imaging Technology: TSA Needs Additional Information Before Procuring 
Next-Generation Systems, GAO-14-357 (Washington, DC: March 31, 2014). 

'®GAO, Arizona Border Surveillance Technology Plan: Additional Actions Needed to Strength- 
en Management and Assess Effectiveness, GAO-14—368 (Washington, DC: Mar. 3, 2014). 

The financial management outcomes have twice been revised since September 2010 when 
they were initially established. The most recent revision occurred in March 2014 when GAO and 
DHS agreed to revise the outcomes to clarify certain requirements and eliminate overlap among 
the outcomes and between the outcomes and GAO’s high-risk removal criteria. 

2' Environmental liabilities consist of environmental remediation, clean-up, and decommis- 
sioning. A significant deficiency is a deficiency, or combination of deficiencies, in internal control 
important enough to merit attention by those charged with governance. A material weakness 
is a significant deficiency, or a combination of significant deficiencies, in internal control such 
that there is a reasonable possibility that a material misstatement of the entity’s financial state- 
ments will not be prevented, or detected and corrected, on a timely basis. 
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Enforcement (ICE), and the Federal Emergency Management Agency (FEMA). 
Both USCG and ICE have made some progress toward modernizing their sys- 
tems and foresee moving to a Federal shared service provider and completing 
their efforts in the latter part of 2016 and 2017.^^ Because of critical stability 
issues with its legacy financial system that were resolved in May 2013, FEMA 
postponed its modernization efforts and has not restarted them. 

IT Management . — DHS has fully addressed 1 of the 6 IT management outcomes 
and partially addressed the remaining 5. In particular, the Department has 
stren^hened its enterprise architecture program (or blueprint) to guide IT acquisi- 
tions by, among other things, largely addressing our prior recommendations aimed 
at adding needed architectural depth and breadth, thus fully addressing this out- 
come. However, the Department needs to continue to demonstrate progress in 
strengthening other core IT management areas. For example, 

• While the Department is taking the necessary steps to enhance its IT security 
program, such as finalizing its annual Information Security Performance Plan, 
further work will be needed for DHS to eliminate the Department’s current ma- 
terial weakness in its information security. It will be important for the Depart- 
ment to fully implement its plan, since DHS’s financial statement auditor re- 
ported in December 2013 that flaws in the security controls such as access con- 
trols, contingency planning, and segregation of duties were a material weakness 
for financial reporting purposes. 

• While important steps have been taken to define IT investment management 
processes generally consistent with best practices, work is needed to dem- 
onstrate progress in implementing these processes across DHS’s 13 IT invest- 
ment portfolios. In July 2012, we recommended that DHS finalize the policies 
and procedures associated with its new tiered IT governance structure and con- 
tinue to implement key processes supporting this structure. DHS agreed with 
these recommendations; however, as of April 2014, the Department had not fi- 
nalized the key IT governance directive, and the draft structure has been imple- 
mented across only 5 of the 13 investment portfolios. 

Fully addressing these actions would also help DHS to address key IT oper- 
ations efficiency initiatives, as well as to more systematically identify other op- 
portunities for savings. For example, as part of the Office of Management and 
Budget’s data center consolidation initiative, we reported that DHS planned to 
consolidate from 101 data centers to 37 data centers by December 2015. Fur- 
ther, DHS officials told us that the Department had achieved actual cost sav- 
ings totaling about $140 million in fiscal years 2011 through 2013, and that it 
estimates total consolidation cost savings of approximately $650 million through 
fiscal year 2019. 

• DHS has also made progress in establishing and implementing sound IT system 
acquisition processes, but continued efforts are needed to ensure that the De- 
partment’s major IT acquisition programs are applying these processes and ob- 
taining more predictable outcomes. In 2013, DHS’s Office of the Chief Informa- 
tion Officer led an assessment of its major IT programs (against industry best 
practices in key IT system acquisition process areas) to determine its capability 
strengths and weaknesses, and has work under way to track programs’ progress 
in addressing identified capability gaps, such as requirements management and 
risk analysis. While this gap analysis and approach for tracking implementation 
of corrective actions are important steps, DHS will need to show that these ac- 
tions are resulting in better, more predictable outcomes for its major IT system 
acquisitions. Demonstrated progress in closing these gaps is especially impor- 
tant in light of our recent reports on major DHS IT programs experiencing sig- 
nificant challenges largely because of system acquisition process shortfalls, in- 


22 A shared service provider is a third-party entity that manages and distributes software- 
based services and solutions to customers across a wide area network from a central data center. 

23 The 13 portfolios are intelligence, domain awareness, securing, screening, law enforcement, 
information sharing and safeguarding, continuity-of-operations planning, benefits administra- 
tion, incident management, enterprise business services, enterprise financial management, en- 
terprise IT services, and enterprise human capital. 

24 GAO, Information Technology: DHS Needs to Further Define and Implement Its New Gov- 
ernance Process.GAO— 12— 818 (Washington, DC: July 25, 2012). 

23 The draft structure has been implemented across the following five portfolios: Intelligence, 
screening, information sharing and safeguarding, enterprise IT services, and enterprise human 
capital. 

23 GAO, Data Center Consolidation: Agencies Making Progress on Efforts, but Inventories and 
Plans Need to Be Completed, GAO-12-742 (Washington, DC: July 19, 2012). 
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eluding DHS’s major border security system modernization, known as TECS- 

Mod.27 

Management integration. — DHS has made substantial progress integrating its 
management functions, fully addressing 3 of the 4 outcomes we identified as key 
to the Department’s management integration efforts. For example, DHS issued a 
comprehensive plan to guide its management integration efforts — the Integrated 
Strategy for High-Risk Management — in January 2011, and has generally improved 
upon this plan with each update. In addition, in April 2014, the Secretary of Home- 
land Security issued a memorandum committing to improving DHS’s planning, pro- 
gramming, budgeting, and execution processes through strengthened Departmental 
structures and increased capability.^® To achieve the last and most significant out- 
come — implement actions and outcomes in each management area to develop con- 
sistent or consolidated processes and systems within and across its management 
functional areas — DHS needs to continue to demonstrate sustainable progress inte- 
grating its management functions within and across the Department and its compo- 
nents and take additional actions to further and more effectively integrate the De- 
partment. 

For example, recognizing the need to better integrate its lines of business, in Feb- 
ruary 2013, the Secretary of Homeland Security signed a policy directive estab- 
lishing the principles of the Integrated Investment Life-Cycle Management to guide 
planning, executing, and managing critical investments Department-wide. DHS’s 
June 2013 Integrated Strategy for High-Risk Management identified that Integrated 
Investment Life-Cycle Management will require significant changes to DHS plan- 
ning, executing, and managing critical investments. At that time, DHS was piloting 
elements of the framework to inform a portion of the fiscal year 2015 budget. DHS’s 
May 2014 strategy update states that the Department plans to receive an inde- 
pendent analysis of the pilots in May 2014. Given that these efforts are under way, 
it is too early to assess their impact. 

As we reported in March 2013, to more fully address the Strengthening DHS 
Management Functions high-risk area, DHS needs to continue implementing its In- 
tegrated Strategy for High-Risk Management and show measurable, sustainable 
progress in implementing its key management initiatives and corrective actions and 
achieving outcomes.^® In doing so, it will be important for DHS to: 

• maintain its current level of top leadership support and sustained commitment 
to ensure continued progress in executing its corrective actions through comple- 
tion; 

• continue to implement its plan for addressing this high-risk area and periodi- 
cally report its progress to Congress and GAO; 

• monitor the effectiveness of its efforts to establish reliable resource estimates 
at the Department and component levels, address and work to mitigate any re- 
source gaps, and prioritize initiatives as needed to ensure it has the capacity 
to implement and sustain its corrective actions; 

• closely track and independently validate the effectiveness and sustainability of 
its corrective actions and make midcourse adjustments, as needed; and 

• make continued progress in addressing the 30 actions and outcomes — for the 
majority of which significant work remains — and demonstrate that systems, 
personnel, and policies are in place to ensure that progress can be sustained 
over time.®® 

We will continue to monitor DHS’s efforts in this high-risk area to determine if 
the actions and outcomes are achieved and sustained. 

National Flood Insurance Program 

FEMA has made progress in all of the areas required for removal of the NFIP 
from the high-risk list, but needs to initiate or complete additional actions; also, re- 
cent legislation has created challenges for EEMA in addressing the financial expo- 
sure created by the program. EEMA leadership has displayed a commitment to ad- 
dressing these challenges and has made progress in a number of areas, such as fi- 
nancial reporting and continuity planning. While EEMA has plans for addressing 
and tracking progress on our specific recommendations, it has yet to address many 
of them. For example, FEMA has not completed actions in certain areas, such as 
modernizing its claims and policy management system and overseeing compensation 


®'^GAO, Border Security: DHS’s Efforts to Modernize Key Enforcement Systems Could be 
Strengthened, GAO— 14-62 (Washington, DC: Dec. 5, 2013). 

2® DHS, Secretary of Homeland Security, Strengthening Departmental Unity of Effort, Memo- 
randum for DHS Leadership (Washington, DC: April 22, 2014). 

GAO, High-Risk Series, Government-wide 2013 Update and Progress Made by the Depart- 
ment of Homeland Security, GAO— 13-444T (Washington, DC: March 21, 2013). 
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of insurers that sell NFIP policies. Completing such actions will likely help improve 
the financial stability and operations of the program. Table 2 summarizes DHS’s 
progress in addressing the NFIP high-risk area. 

TABLE 2.— ASSESSMENT OF DEPARTMENT OF HOMELAND SECURITY 
PROGRESS IN ADDRESSING THE NATIONAL FLOOD INSURANCE PRO- 
GRAM HIGH-RISK AREA, AS OF MAY 2014 


Criterion for Removal From the High-Risk List 


Mot 1 Partially 
Met 2 


Not 

Met® 


Leadership commitment X 

Corrective action plan X 

Capacity X 

Framework to monitor progress X 

Demonstrated, sustained progress X 


Total 0 5 0 


Source: GAO analysis of Federal Emergency Management Agency documents, interviews, 
and prior GAO reports. 

®“Met”: There are no significant actions that need to be taken to further address this cri- 
terion. 

2 “Partially met”: Some but not all actions necessary to generally meet the criterion have 
been taken. 

® “Not met”: Few, if any, actions toward meeting the criterion have been taken. 

Leadership commitment (partially met). FEMA officials responsible for the 
NFIP have shown a commitment to taking a number of actions to implement our 
recommendations, which are designed to improve both the financial stability and op- 
erations of the program. For example, they have indicated a commitment to imple- 
menting our recommendations and have been proactive in clarifying and taking the 
actions needed to do so. In addition, FEMA officials have met with us to discuss 
outstanding recommendations, the actions they have taken to address them, and ad- 
ditional actions they could take. Further, a DHS official said that FEMA holds reg- 
ular meetings to discuss the status of open recommendations. 

Recent legislative changes, however, have presented challenges for FEMA in ad- 
dressing the financial exposure created by the NFIP. For example, in July 2012, the 
Biggert-Waters Flood Insurance Reform Act of 2012 (Biggert-Waters Act) was en- 
acted, containing provisions to help strengthen the future financial solvency and ad- 
ministrative efficiency of NFIP, including phasing out almost all discounted insur- 
ance premiums (commonly referred to as subsidized premiums).®® In July 2013, we 
reported that FEMA was starting to implement some of the required changes.®® 
However, on March 21, 2014, the Homeowner Flood Insurance Affordability Act of 
2014 (2014 Act) was enacted, reinstating certain premium subsidies and restoring 
grandfathered rates removed by the Biggert-Waters Act.®® The 2014 Act addresses 
affordability concerns for certain property owners, but may also increase NFIP’s 
long-term financial burden on taxpayers.®® 

Corrective action plan (partially met). — While FEMA developed corrective ac- 
tion plans for implementing the recommendations in individual GAO reports, it has 
not developed a comprehensive plan to address the issues that have placed the 
NFIP on GAO’s high-risk list. While addressing our recommendations is part of such 
a plan, a comprehensive plan also defines the root causes, identifies effective solu- 
tions, and provides for substantially completing corrective measures near term. Ac- 
cording to a DHS official, the individual action plans collectively represent their 
plan for addressing these issues, as the recommendations cover steps needed to im- 
prove the program’s financial stability as well as its administration. The official 
added that DHS has developed more comprehensive plans for other high-risk areas, 
which have been helpful, and could consider doing so for the NFIP, but such plans 
require a lot of work. Such a plan could help FEMA ensure that all important 
issues, and all aspects of those issues, are addressed. For example, while our rec- 
ommendations regarding the NFIP’s financial stability have focused on the extent 


®ipub. L. No. 112-141, Div. F, Title II, Subtit. A, 126 Stat. 405, 916 (July 6, 2012). 

®2GA0, Flood Insurance: More Information Needed on Subsidized Properties, GAO— 13-607 
(Washington, DC: July 3, 2013). 

3® Pub. L. No. 113-89, 128 Stat. 1020 (Mar. 21, 2014). 

®®GAO, Flood Insurance: Strategies for Increasing Private Seetor Involvement, GAO— 14-127 
(Washington, DC: Jan. 22, 2014). 
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of subsidized rates and the rate-setting process, financial stability could include 
other important areas, such as debt management. As of December 2013, FEMA 
owed the Treasury $24 billion — primarily to pay claims associated with Superstorm 
Sandy (2012) and Hurricane Katrina (2005) — and had not made a principal payment 
since 2010. 

Capacity (partially met). — FEMA faces several challenges in improving the pro- 
gram’s financial stability and operations. First, recent legislative changes permit 
certain premium subsidies and restore grandfathered rates removed by the Biggert- 
Waters Act. These provisions, along with others, may weaken the potential for im- 
proved financial soundness of the NFIP program. Second, while FEMA is estab- 
lishing a reserve fund as required by the Biggert- Waters Act, it is unlikely to ini- 
tially meet the act’s annual targets for building up the reserve, partly because of 
statutory limitations on annual premium increases. Third, while FEMA has begun 
taking some actions to improve its administration of the NFIP, it is unclear how 
the resources required to implement both the Biggert- Waters Act and the 2014 Act 
will affect its ability to continue and complete these efforts. For example, the Acts 
require FEMA to complete multiple studies and take a number of actions within the 
next several years, which will require resources FEMA would normally have com- 
mitted to other efforts. 

Monitoring Progress (partially met). — FEMA has a process in place to mon- 
itor progress in taking actions to implement our recommendations related to the 
NFIP. For example, the status of efforts to address the recommendations is regu- 
larly discussed both within the Flood Insurance and Mitigation Administration, 
which administers the NFIP, and at the DHS level, according to a DHS official. 
However, it does not have a specific process for independently validating the effec- 
tiveness or sustainability of those actions. Instead, according to a DHS official, once 
a recommendation related to the NFIP is implemented, the effects of the actions 
taken to do so are not tracked separately, but are evaluated as part of regular re- 
views of the effectiveness of the entire program. Broader monitoring of the effective- 
ness and sustainability of its actions would help ensure that appropriate corrective 
actions are being taken. 

Demonstrated, sustained progress (partially met). — FEMA has begun to 
take actions to improve the program’s financial stability, such as initiating actions 
to improve the accuracy of full-risk rates.®® However, these efforts are not complete, 
and FEMA does not have some information, such as the number and location of ex- 
isting grandfathered properties and information necessary to appropriately revise 
premium rates for previously subsidized properties.®® Similarly, FEMA has taken a 
number of actions to improve areas of the program’s operations, such as financial 
reporting and continuity planning.®^ However, some important actions, such as mod- 
ernizing its policy and claims management system and ensuring the reasonableness 
of compensation to insurance companies that sell and service most NFIP policies, 
remain to be completed.®® Sustained progress will be needed for FEMA to address 
the financial and operational issues facing NFIP. 

GOVERNMENT- WIDE HIGH-RISK AREAS IN WHICH DHS PLAYS A CRITICAL ROLE 

Progress has been made in the Government-wide high-risk areas in which DHS 
plays a critical role, but significant work remains. 

Information Security and Cyber Critical Infrastructure Protection 

As we reported in our February 2013 high-risk update, the White House and Fed- 
eral agencies, including DHS, have taken a variety of actions that were intended 
to enhance Federal and critical infrastructure cybersecurity. For example, the Gov- 
ernment issued numerous strategy-related documents over the past decade and es- 
tablished agency performance goals and a mechanism to monitor performance in 
three cross-agency priority areas of strong authentication. Trusted Internet Connec- 
tions, and continuous monitoring.®® 


®®GAO, Flood Insurance: FEMA’s Rate-Setting Process Warrants Attention, GAO— 09-12 
(Washington, DC: Oct. 31, 2008). 

®®GAO-13-607. 

GAO, FEMA: Action Needed to Improve Administration of the National Flood Insurance Pro- 
gram, GAO-11-297 (Washington, DC: June 9, 2011). 

®®ClAO, Flood Insurance: Opportunities Exist to Improve Oversight of the WYO Program, 
GAO-09-155 (Washington, DC: Aug. 21, 2009) and GAO-11-297. 

Strong authentication involves increasing the use of Federal smartcard credentials such as 
Personal Identity Verification and Common Access Cards that provide multi-factor authentica- 
tion and digital signature and encryption capabilities, authorizing users to access Federal infor- 
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In addition, since the February 2013 high-risk update, the administration has 
continued its cyber-related efforts. In February 2013, the President issued Presi- 
dential Policy Directive 21 on critical infrastructure security and resilience and 
Executive Order 13636 on improving critical infrastructure cybersecurity.'*'^ These 
documents assign specific actions to particular individuals and agencies with spe- 
cific time frames for completion. 

However, more efforts are needed by Federal organizations, including the White 
House, DHS, and other agencies, to address a number of areas. To illustrate the 
scope and persistence of this challenge, in fiscal year 2013, inspectors general at 21 
of the 24 agencies cited information security as a major management challenge for 
their agencies,"*^ and 18 agencies reported that information security control defi- 
ciencies were either a material weakness or a significant deficiency in internal con- 
trols over financial reporting in fiscal year 2013.^® 

DHS’s Role in Federal Information Security and Cyber Critical Infrastructure 
Protection 

In addition to having responsibilities for securing its own information systems and 
data, DHS plays a pivotal role in Government-wide cybersecurity efforts. In par- 
ticular, in July 2010, the Director of the Office of Management and Budget (0MB) 
and the White House Cybersecurity Coordinator issued a joint memorandum that 
transferred several key 0MB responsibilities under the Federal Information Secu- 
rity Management Act of 2002 (FISMA) to DHS.^'^ Specifically, DHS is to exercise 
primary responsibility within the Executive branch for overseeing and assisting 
with the operational aspects of cybersecurity for Federal systems that fall within the 
scope of FISMA. 

We agree that DHS should play a role in the operational aspects of Federal cyber- 
security. We suggested in February 2013 that Confess consider legislation that 
would clarify roles and responsibilities for implementing and overseeing Federal in- 
formation security programs and for protecting the Nation’s critical cyber assets."*® 

Regarding cyber critical infrastructure protection, a fundamental component of 
DHS’s efforts is its partnership approach, whereby it engages in partnerships among 
Government and industry stakeholders. Such an approach is essential because the 
majority of critical infrastructure in the United States is owned and operated by the 
private sector. In 2006, DHS issued the National Infrastructure Protection Plan. 
The plan, subsequently updated several times, provides the overarching approach 
for integrating the Nation’s critical infrastructure protection and resilience activities 
into a single National effort."*® Congress is considering several bills that would ad- 
dress cyber information sharing and the cybersecurity posture of the Federal Gov- 
ernment and the Nation. For example, H.R. 3696, the National Cybersecurity and 
Critical Infrastructure Protection Act of 2014, would address DHS’s role and respon- 
sibilities in protecting Federal civilian information systems and critical infrastruc- 
ture from cyber threats.*'^ 

Specific laws. Executive Orders, and directives have further guided DHS’s role in 
cyber critical infrastructure protection. For example. Executive Order 13636 directs 


mation systems with a higher level of assurance. Trusted Internet Connections is an initiative 
to consolidate external telecommunication connections and ensure a set of haseline security ca- 
pabilities for situational awareness and enhanced monitoring. Continuous monitoring of Federal 
information systems includes transforming the otherwise static security control assessment and 
authorization process into a dynamic risk mitigation program that provides essential, near-real- 
time security status and remediation, increasing visibility into system operations and helping 
security personnel make risk management decisions based on increased situational awareness. 

*®The White House, Presidential Policy Directive/PPD— 21, Critical Infrastructure Security 
and Resilience (Feb. 12, 2013). 

**Exec. Order No. 13,636, 78 Fed. Reg. 11,739 (Feb. 19, 2013). 

The 24 major departments and agencies are the Departments of Agriculture, Commerce, De- 
fense, Education, Energy, Health and Human Services, Homeland Security, Housing and Urban 
Development, the Interior, Justice, Labor, State, Transportation, the Treasury, and Veterans Af- 
fairs; the Environmental Protection Agency, General Services Administration, National Aero- 
nautics and Space Administration, National Science Foundation, Nuclear Regulatory Commis- 
sion, Office of Personnel Management, Small Business Administration, Social Security Adminis- 
tration, and U.S. Agency for International Development. 

A control deficiency exists when the design or operation of a control does not allow manage- 
ment or employees, in the normal course of performing their assigned functions, to prevent or 
detect and correct misstatements on a timely basis. 

«See Pub. L. No. 107-347, Dec. 17, 2002; 44 U.S.C. 3541, et seq. 

GAO, Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined 
and More Effectively Implemented, GAO— 13-187 (Washinf^on, DC: Feb. 14, 2013). 

*®See, most recently. Department of Homeland Security, NIPP 2013: Partnering for Critical 
Infrastructure Security and Resilience. 

"‘"'H.R. 3696, 113th Cong. (2013). 
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DHS to, among other things, establish a voluntary program to support the adoption 
of a cybersecurity framework by private-sector partners;'^® coordinate the establish- 
ment of a set of incentives designed to promote participation in the voluntary pro- 
gram; and incorporate privacy and civil liberties protections into every initiative 
called for by the Executive Order. 

Securing Federal Systems 

In carrying out its role in overseeing and assisting Federal agencies in imple- 
menting information security requirements, DHS has begun performing several ac- 
tivities. These include: 

• conducting “CyberStat” reviews, which are intended to hold agencies account- 
able and offer assistance in improving their information security posture; 

• holding interviews with agency chief information officers and chief information 
security officers on security status and issues; 

• establishing a program to enable Federal agencies to expand their continuous 
diagnostics and mitigation capabilities; and, 

• refining performance metrics that agencies use for FISMA reporting purposes. 

In February 2014, as part of our continued dialogue with DHS regarding progress 

and what remains to be accomplished in this high-risk area, we identified and com- 
municated to DHS actions critical to addressing its efforts to oversee and assist 
agencies in improving information security practices.'^® This included the following: 

• Expand CyberStat reviews to all major Federal agencies. — DHS has conducted 
CyberStat sessions with several of the 24 major Federal agencies. According to 
DHS officials, the current approach focuses on providing CyberStat reviews for 
the lowest-performing agencies. However, expanding the reviews to include all 
24 agencies could lead to an improved security posture. 

• Enhance FISMA reporting metrics. — In September 2013, we reported that the 
metrics issued by DHS for gau^ng the implementation of priority security goals 
and other important controls did not address key security activities and did not 
always include performance targets.®® We recommended that 0MB and DHS 
collaborate to develop improved metrics, and the agencies stated that they plan 
to implement the recommendation by September 2014. 

• Develop a strategic implementation plan. — DHS’s Office of Inspector General re- 
ported in June 2013 that the Department had not developed a strategic imple- 
mentation plan describing its cybersecurity responsibilities and a clear plan of 
action for fulfilling them. According to DHS officials, it has developed this plan 
and is awaiting closure of the inspector general recommendation. We will re- 
view the status of this plan as part of our on-going review of this high-risk area. 

• Continue to develop continuous diagnostics and mitigation capabilities and as- 
sist agencies in developing and acquiring them. — This effort is intended to pro- 
tect networks and enhance an agency’s ability to see and counteract day-to-day 
cyber threats. 

The successful implementation of these actions should result in outcomes such as 
enhanced DHS oversight and assistance through CyberStat, improved metrics and 
other outcomes, improved situational awareness, and enhanced capabilities for as- 
sisting agencies in responding to cyber incidents. In conjunction with needed actions 
by Federal agencies, this could contribute to improved information security Govern- 
ment-wide. 

Protecting Cyber Critical Infrastructure 

DHS, in conjunction with other Executive branch entities, has taken steps to en- 
hance the protection of cyber critical infrastructure. For example, according to DHS, 
it has: 

• expanded the capacity of its National Cybersecurity and Communications Inte- 
gration Center to facilitate coordination and information sharing among Federal 
and private-sector stakeholders; 

• established the Information Sharing Working Group and a mechanism for cre- 
ating cyber threat reports that can be shared with private-sector partners; and, 


As required by Executive Order 13636, the National Institute of Standards and Technology 
(NIST) issued the first version of the cyhersecurity framework in February 2014. See NIST, 
Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0 (Feb. 12, 2014). 

^®We provided DHS detail on the actions that need to he taken and outcomes that need to 
be achieved to address the Federal information security and cyber critical infrastructure protec- 
tion high-risk area. The information we provided DHS was based on our full body of work in 
this area. 

GAO, Federal Information Security: Mixed Progress in Implementing Program Components; 
Improved Metrics Needed to Measure Effectiveness, GAO— 13— 776 (Washington, DC: Sept. 26, 
2013). 
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• set up a voluntary program to encourage critical infrastructure owners and op- 
erators to use the cybersecurity framework developed by the National Institute 
of Standards and Technology, as required by Executive Order 13636. 

In February 2014, we identified and communicated to DHS actions critical to ad- 
dressing cyber critical infrastructure protection, including the following: 

• expand the Enhanced Cyhersecurity Services program, which is intended to pro- 
vide Classified cyber threat and technical information to eligible critical infra- 
structure entities, to all critical infrastructure sectors as required by Executive 
Order 13636; 

• enhance coordination efforts with private-sector entities to facilitate improve- 
ments to the cybersecurity of critical infrastructure; and, 

• identify a set of incentives designed to promote implementation of the NIST cy- 
bersecurity framework. 

Completing these efforts could assist in achieving a flow of timely and actionable 
cybersecurity threat and incident information among Federal stakeholders and crit- 
ical infrastructure entities, adoption of the cybersecurity framework by infrastruc- 
ture owners and operators, and effective implementation of security controls over a 
significant portion of critical cyber assets. As we reported in March 2014, more 
needs to be done to accelerate the progress made in bolstering the cybersecurity pos- 
ture of the Nation and Federal Government. The administration and Executive 
branch agencies need to implement the hundreds of recommendations made by GAO 
and agency inspectors general to address cyber challenges, resolve known defi- 
ciencies, and fully implement effective information security programs. Until then, a 
broad array of Federal assets and operations will remain at risk of fraud, misuse, 
and disruption, and the Nation’s most critical Federal and private-sector infrastruc- 
ture systems will remain at increased risk of attack from our adversaries.®'^ 

Enhancing the Sharing of Terrorism-Related Information 

DHS has made significant progress in enhancing the sharing of information on 
terrorist threats and in supporting Government-wide efforts to improve such shar- 
ing.®2 Our work on assessing the high-risk area on sharing terrorism-related infor- 
mation has primarily focused on Federal efforts to implement the Information Shar- 
ing Environment, as called for in the Intelligence Reform and Terrorism Prevention 
Act of 2004.®® The Information Sharing Environment is a Government-wide effort 
to improve the sharing of terrorism-related information across Federal agencies and 
with State, local, territorial. Tribal, private-sector, and foreign partners. When as- 
sessing progress, we review the activities of both the program manager for the Infor- 
mation Sharing Environment — a position established under the 2004 Act with re- 
sponsibility for information sharing across the Government — as well as efforts of 
DHS and other key entities, including the Departments of Justice, State, and De- 
fense, and the Office of the Director of National Intelligence.®^ Accordingly, DHS 
itself is not on the high-risk list nor can DHS’s efforts fully resolve the high-risk 
issue. Nevertheless, DHS plays a critical role in Government-wide sharing given its 
homeland security missions and responsibilities. 

Overall, the Federal Government has made progress in addressing the terrorism- 
related information-sharing high-risk area. As we reported in our February 2013 up- 
date, the Federal Government is committed to establishing effective mechanisms for 
managing and sharing terrorism-related information, and has developed a National 
strategy, implementation plans, and methods to assess progress and results. While 
progress has been made, the Government needs to take additional action to mitigate 
the potential risks from gaps in sharing information, such as ensuring that it is 
leveraging individual agency initiatives to benefit all partners and continuing work 
to develop metrics that measure the homeland security results achieved from im- 
proved sharing. We are currently conducting work with the program manager and 
key entities to determine their progress in meeting the criteria since the 2013 high- 
risk report. 


GAO, Government Efficiency and Effectiveness: Views on the Progress and Plans for Address- 
ing Government-wide Management Challenges, GAO— 14-436T (Washington, DC: March 12, 
2014). 

Terrorism-related information includes homeland security, terrorism, and weapons of mass 
destruction information. See 6 U.S.C. §§ 482(f)(1), 485(a)(1), (5)A6). 

S3 See Pub. L. No. 108-458, §1016, 118 Stat. 3638, 3664-70 (2004) (codified as amended at 
6 U.S.C. §485). 

s^The Office of the Director of National Intelligence was established in 2004 to manage the 
efforts of the intelligence community. See 50 U.S.C. § 3023. Its mission is to lead intelligence 
integration and forge an intelligence community that delivers the most insightful intelligence 
possible. 
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DHS’s Role in the Sharing of Terrorism-Related Information 

Separately, in response to requests from this committee and other Congressional 
committees, we have assessed or are currently assessing DHS’s specific efforts to en- 
hance the sharing of terrorism-related information. As discussed below, this work 
includes DHS efforts to: (1) Support State and major urban area fusion centers,®® 
(2) coordinate with other Federal agencies that support task forces and other centers 
in the field that share information on threats as part of their activities, (3) achieve 
its own information-sharing mission, and (4) share information related to the De- 
partment’s intelligence analysis efforts. 

Fusion centers. — A major focus of the high-risk area and Information Sharing En- 
vironment has been to improve the sharing of terrorism-related information among 
the Federal Government and State and local security partners, which is done in part 
through State and major urban area fusion centers. DHS is the Federal lead for 
supporting these centers and has made significant strides. For example, DHS has 
deployed personnel to centers to serve as liaisons to the Department and help cen- 
ters develop capabilities (such as the ability to analyze and disseminate informa- 
tion), provided grant funding to support center activities, provided access to net- 
works disseminating Classified and Unclassified information, and helped centers 
identify and share reports on terrorism-related suspicious activities. DHS has been 
very responsive to a recommendation in our 2010 report that calls for establishing 
metrics to determine what return the Federal Government is getting for its invest- 
ments in centers.®® We have an on-going review of DHS’s efforts to assess center 
capabilities, manage Federal grant funding, and determine the contributions centers 
make to enhance homeland security, and expect to issue a report later this year. 

Field-based entities that share information. — DHS is also taking steps to measure 
the extent to which fusion centers are coordinating and sharing information with 
other field-based task forces and centers — such as Federal Bureau of Investigation 
Joint Terrorism Task Forces — and assess opportunities to improve coordination.®'^ In 
April 2013, we reported that fusion centers and other field-based entities had over- 
lapping activities, but the agencies that support them had not held the entities ac- 
countable for coordinating and collaborating or assessed opportunities to enhance co- 
ordination, and recommended that the agencies develop mechanisms to do so.®® In 
response, DHS began tracking collaboration mechanisms, such as which fusion cen- 
ters have representatives from the other entities on their executive boards, are co- 
located with other entities, and issue products jointly developed with other entities. 

DHS’s efforts can help avoid unnecessary overlap in activities, which in turn can 
help entities leverage scarce resources. To fully address our recommendation, how- 
ever, the other Federal agencies must take steps to better hold their respective field 
entities accountable for such collaboration. In addition, these agencies must work 
with DHS to collectively assess Nation-wide any opportunities for field entities to 
further implement collaboration mechanisms. 

DHS information-sharing mission. — In September 2012, we reported that DHS 
had made progress in achieving its own information-sharing mission, but could take 
additional steps to improve its efforts.®® Specifically, DHS had demonstrated leader- 
ship commitment by establishing a governance board to serve as the decision-mak- 
ing body for DHS information-sharing issues. The board has enhanced collaboration 
among DHS components and identified a list of key information-sharing initiatives 
to pursue, among other things. We found, however, that 5 of DHS’s top 8 priority 
initiatives faced funding shortfalls. We also reported that DHS had taken steps to 
track its information-sharing efforts, but had not fully assessed how such efforts had 
improved sharing. We recommended that DHS: (1) Revise its policies and guidance 


®®In general, fusion centers are collaborative efforts of two or more agencies that provide re- 
sources, expertise, and information to the center with the goal of maximizing their ability to 
detect, prevent, investigate, and respond to criminal and terrorist activity. See 6 U.S.C. 
§ 124h(j)(l). There are 78 fusion centers in the United States. 

®®GAO, Information Sharing: Federal Agencies Are Helping Fusion Centers Build and Sustain 
Capabilities and Protect Privacy, hut Could Better Measure Results, GAO-10— 972 (Washington, 
DC: Sept. 29, 2010). 

®'^The five types of entities we reviewed are State and major urban area fusion centers, Joint 
Terrorism Task Forces, Field Intelligence Groups, Regional Information Sharing Systems Cen- 
ters, and High-Intensity Drug Trafficking Area Investigative Support Centers. DHS, the Depart- 
ment of Justice, and the Office of National Drug Control Policy oversee or otherwise support 
these entities. 

®®GAO, Information Sharing: Agencies Could Better Coordinate to Reduce Overlap in Field- 
Based Activities, GAO-13^71 (Washington, DC: Apr. 12, 2013). 

®®GAO, Information Sharing: DHS Has Demonstrated Leadership and Progress, hut Addi- 
tional Actions Could Help Sustain and Strengthen Efforts, GAO— 12-809 (Washington, DC: Sept. 
18, 2012). 
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to include processes for identifying information-sharing gaps; analyzing root causes 
of those gaps, and identifying, assessing, and mitigating risks of removing incom- 
plete initiatives from its list, and (2) better track and assess the progress of key ini- 
tiatives and the Department’s overall progress in achieving its information-sharing 
vision. DHS has since taken actions — such as issuing revised guidance and devel- 
oping new performance measures — to address all of these recommendations. 

Sharing intelligence analysis. We are finalizing a report on DHS’s intelligence 
analysis capabilities, which are a key part of the Department’s efforts in securing 
the Nation. Within DHS, the Office of Intelligence and Analysis has a lead role for 
intelligence analysis, but other operational components — such as CBP and ICE — 
also perform their own analysis activities and are part of the DHS Intelligence En- 
terprise. Our report, expected to be issued later this month, will address: (1) The 
extent to which the intelligence analysis activities of the enterprise are integrated 
to support Departmental strategic intelligence priorities, and are unnecessarily 
overlapping or duplicative; (2) the extent to which Office of Intelligence and Anal- 
ysis customers report that they find products and other analytic services to be use- 
ful, and what steps, if any, the office has taken to address any concerns customers 
report; and (3) challenges the Office of Intelligence and Analysis has faced in main- 
taining a skilled analytic workforce and steps it has taken to address these chal- 
lenges. We are planning to make recommendations to help DHS enhance its intel- 
ligence analysis capabilities and related sharing of this information.®° 

Overall, DHS’s continued progress in enhancing the sharing of terrorism-related 
information and responding to our findings and recommendations will be critical to 
supporting Government-wide sharing and related efforts to secure the homeland. 

Chairman McCaul, Ranking Member Thompson, and Members of the committee, 
this completes my prepared statement. I would be happy to respond to any ques- 
tions you may have at this time. 

Chairman McCaul. Well, thank you, sir. We thank you for your 
comments as well. 

Chairman now recognizes Mr. Roth. 

STATEMENT OF JOHN ROTH, INSPECTOR GENERAL, U.S. 

DEPARTMENT OF HOMELAND SECURITY 

Mr. Roth. Good morning. Chairman McCaul, Ranking Member 
Thompson, and Members of the committee. Thank you for inviting 
me here today to discuss some of the high-risk areas that DHS 
faces. 

My testimony here today will focus on acquisition management. 
In particular, as our work has shown, DHS is not as effective and 
efficient as it could be in this area. We find that it stems from 
three main areas. 

First, DHS’s unique mission requires complicated acquisitions. 
Whether it is acquiring a fleet of helicopters, building a border 
fence over hundreds of miles of varied terrain, integrating and 
managing systems from diverse legacy agencies, or purchasing 
technologically-complex airport screening machines are, under the 
best of circumstances, high-risk acquisitions. 

Second, DHS, as has been noted this morning, is working to- 
wards a transparent acquisition governance process, which if it is 
fully followed would lead to better and smarter acquisitions. Unfor- 
tunately, the DHS components engaged in the acquisitions often do 
not follow the DHS procurement policies, and DHS lacks a means 
to enforce compliance. 

Third, components acquisition decisions often work against the 
Department’s stated goal of One DHS. DHS components, in a word, 
operate in a vacuum. They fail to take into account other compo- 


®^The Office of Intelligence and Analysis’ five customer groups are: (1) DHS leadership; (2) 
DHS operational components; (3) intelligence community members; (4) State, local, Tribal, and 
territorial partners; and (5) private critical infrastructure sectors. 
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nents’ needs or they fail to leverage other assets or other acquisi- 
tions that are already underway. 

We have done a number of audits that give examples of this. 
Those are in my written testimony. But I would like just to talk 
about one single audit that we did with regard to using acquisi- 
tions to have One DHS. 

DHS’s stated goal is to ensure interoperability of communica- 
tions. We want to make sure that the first responders and other 
law enforcement agencies — agents, particularly within DHS, can 
talk to each other through a common channel in the event of a ter- 
rorist event or a crisis of some sort. 

DHS has about 123,000 radio field users within eight different 
components, and DHS has invested about $430 million in equip- 
ment, infrastructure, and other resources to ensure interoper- 
ability. 

We conducted an audit in late 2012 and asked 479 DHS field 
radio users to access and use the specified channel to communicate. 
Out of those 479 people we asked to do so, only a single user could 
use the common channel. 

In other words, DHS had a failure rate of 99.8 percent. Seventy- 
two percent of the users didn’t even realize that there was — didn’t 
even know the existence of a common channel. The remainder just 
couldn’t find it. Of the radios we examined only 20 percent of them 
were properly set up to use the common channel. 

This test happened 11 years after 9/11. Without an effective gov- 
erning structure DHS cannot achieve its goal of a Department-wide 
radio interoperability. As we sit here today the Department’s plans 
to do so are still a work in progress. 

In closing I would like to note that DHS has taken steps to im- 
plement our recommendations and to progress towards a unity of 
effort. However, the Department is persistently challenged in act- 
ing in an integrated single entity. 

This concludes my prepared statement. I am happy to take ques- 
tions from the committee. Thank you. 

[The prepared statement of Mr. Roth follows:] 

Prepahed Statement of John Roth 
May 7, 2014 

Good morning Chairman McCaul, Ranking Member Thompson, and Members of 
the committee. Thank you for inviting me here today to discuss high-risk areas at 
DHS identified by GAO. 

In its report, High-risk Series: An Update (GAO-13-283, February 2013), GAO 
identified high-risk areas in the Federal Government, including areas of particular 
concern at DHS. My testimony today will focus on some high-risk areas that we also 
identified in our December 2013 report, Major Management and Performance Chal- 
lenges Facing the Department of Homeland Security (OIG-14-17), particularly in 
managing acquisitions. 

Our work has shown that DHS’ management of its acquisitions is not as effective 
and efficient as it could be. This problem stems from three main issues: 

• First, DHS’ unique mission requires multi-faceted and sophisticated acquisi- 
tions. Whether acquiring a fleet of helicopters, building a border fence over hun- 
dreds of miles of varied terrain, or integrating and managing systems from di- 
verse legacy agencies, DHS’ requirements increase the complexity and risk of 
its acquisitions. 

• Second, DHS is working toward a transparent, authoritative governing proc- 
ess — the Acquisition Life-cycle Framework (ALF) — which, if fully implemented, 
would lead to better oversight and guidance of acquisitions. Unfortunately, DHS 
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components often do not follow this governing process (or any other) in carrying 
out their acquisitions, and DHS has had difficulty enforcing compliance. 

• Third, the components’ acquisition decisions often work counter to the Depart- 
ment’s stated goal of “One DHS.” In planning and managing acquisitions, com- 
ponents often operate in a vacuum; they fail to take into account the needs of 
other components or they fail to leverage other assets or acquisitions already 
underway. 

We have made recommendations to improve the efficiency and effectiveness of 
DHS’ programs and operations, and DHS has taken some steps to implement our 
recommendations. However, the Department continues to struggle with acting as an 
integrated, single entity to accomplish its mission. 

NATURE OF THE RISK 

Acquisition management at DHS is inherently complex and high-risk. It is further 
challenged by the magnitude and diversity of the Department’s procurements. In fis- 
cal year 2013, DHS’ Major Acquisition Oversight List included 123 programs; 88 (72 
percent) of the programs were Level 1 or Level 2. Level 1 and Level 2 programs 
have life-cycle costs of $300 million or more or have special Departmental interest. 
Some examples of Level 1 and Level 2 acquisitions include: 

• The United States Coast Guard’s HC-144A Maritime Patrol Aircraft, a twin en- 
gine turboprop airplane designed for superior situational awareness, a reduced 
workload, and increased crew safety. Life-cycle cost estimate — $24.9 billion; 

• U.S. Customs and Border Protection’s (CBP) Automated Commercial Environ- 
ment, a system to enable CBP to interact, manage, and oversee import and ex- 
port data, and manage custodial revenue and enforcement systems. Life-cycle 
cost estimate — $4.5 billion; 

• TSA’s Screening Partnership Program, procures screening services from private 
companies at TSA airports. Life-cycle cost estimate — $2.4 billion; 

• CBP’s Mission Support Facilities to develop, plan, execute, and sustain facilities 
and infrastructure inventory to support CBP’s Mission Support Offices Nation- 
wide. Facilities include administrative offices, training centers, laboratories, and 
warehouses. Life-cycle cost estimate — $2 billion; 

• CBP’s Integrated Fixed Towers, a system for automated, persistent wide area 
surveillance to detect, track, identify, and classify illegal entries. Life-cycle cost 
estimate — $842 million. 

COMBATING THE RISK: ACQUISITION MANAGEMENT FRAMEWORK 

Effective acquisition management requires careful planning and oversight of proc- 
esses, solid internal controls, and compliance with laws and regulations. Acquisi- 
tions must be planned and managed through their entire life cycle to ensure that 
they are procured, deployed, and used efficiently and effectively. 

DHS has developed a comprehensive acquisition framework of policies, proce- 
dures, and entities to streamline its acquisition practices and ensure that procured 
goods and services meet mission needs cost-efficiently. This system should lead to 
informed investment decisions on goods and services that fulfill DHS’ mission. 

Acquisition Phases 

DHS has adopted the Acquisition Life-Cycle Framework (ALF), composed of the 
following four phases, to determine whether to proceed with an acquisition: 

1. Need — identify the need that the acquisition will address; 

2. Analyze/Select — analyze the alternatives to satisfy the need and select the 
best option; 

3. Obtain — develop, test, and evaluate the selected option and determine wheth- 
er to approve production; and 

4. Produce/Deploy/Support — produce and deploy the selected option and support 
it throughout the operational life cycle. 

Each phase of the ALF leads to an “Acquisition Decision Event” (ADE), a pre- 
determined point at which the acquisition is reviewed before it can move to the next 
phase. The reviews are intended to ensure alignment of needs with DHS’ strategic 
direction and adequate planning for upcoming phases. 

The figure below shows the four phases of the ALF and each ADE. 
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ADE-O Identify the need 

ADE-1 Validate the need 

ADE-2A Approve the program 

ADE-2B Approve projects within the program 

ADE-2C Approve low rate initial production 

ADE-3 Approve full rate production and deployment 

ADE 4* Project transition — a milestone unique to the Coast Guard, authorizes the 
project to move to sustainment 

The ALF is a rigorous, disciplined process designed to result in cost-efficient ac- 
quisitions that can meet the Department’s needs and help accomplish its mission. 

Acquisition Entities, Policies, and Procedures 

DHS’ Office of Program Accountability and Risk Management (PARM) admin- 
isters the ALF and oversees all major DHS acquisitions. PARM reports directly to 
the under secretary for management and manages and implements the Depart- 
ment’s Acquisition Management Directive. PARM is also responsible for independ- 
ently assessing major investment programs and monitoring programs between for- 
mal reviews to identify issues. 

DHS has established the following mechanisms to govern acquisitions: 

• The Acquisition Review Board (ARB). — A cross-component board composed of 
senior-level decisionmakers. The ARB determines whether a proposed acquisi- 
tion meets requirements and can proceed to the next phase and eventual pro- 
duction and deployment. Before every ADE, components must submit acquisi- 
tion documents to the ARB for review, including a mission needs statement, ca- 
pability development plan, and an acquisition plan. 

• Quarterly Program Accountability Report. — Provides a comprehensive, high- 
level analysis of a program’s vital signs provided to DHS leadership, component 
acquisition executives, and program managers. 

• A Joint Requirements Council. — Reviews high-dollar acquisitions and rec- 
ommends savings opportunities to the ARB. 

• Centers of Excellence. — Two have been set up under PARM: Program Manage- 
ment Center of Excellence and Cost Estimating & Analysis Center of Excel- 
lence. Leadership staff and subject-matter experts at the centers provide proven 
practices, guidance, and counsel on program management and cost estimating 
and analysis. 

• The Decision Support Tool. — A web-based central dashboard to assess and track 
the health of major acquisition projects, programs, and portfolios. The Depart- 
ment’s goal is to improve program accountability and make sound strategic deci- 
sions throughout the life-cycle of major acquisitions. 

• Comprehensive Acquisition Status Report. — Provides information on the status 
of major acquisitions. Reports include information such as the current acquisi- 
tion phase, the date of last review, life-cycle cost estimate, and key events and 
milestones. 


FAILING TO FOLLOW THE FRAMEWORK RESULTS IN PROBLEMATIC ACQUISITIONS 

However, as our work has shown, this process is not always followed. Several of 
our audits have highlighted DHS’ challenge in establishing an overarching structure 
that fully integrates the components into overall governance, unified decision mak- 
ing, and collective analysis. 

CBP’s Acquisition ofH-60 Helicopters 

In May 2013, we issued DHS’ H-60 Helicopter Programs (Revised) (OIG-13-89), 
which illustrates the risks of deviating from the ALF. Although the Department had 
some processes and procedures to govern its aviation assets and provide oversight, 
the acquisition was not fully coordinated and acquisition costs, schedules, and per- 
formance were not controlled. 

CBP did not take into account guidance from the DHS Office of the Chief Procure- 
ment Officer (OCPO) in its H-60 acquisition planning. In 2007, CBP’s Office of Air 
and Marine submitted its Congressionally-mandated acquisition plan, which out- 
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lined how its aviation assets and acquisitions would support its mission. CBP lead- 
ership approved the plan to acquire 38 new and converted medium-lift helicopters 
and submitted it to the DHS OCPO. 

On March 3, 2008, OCPO expressed its concerns about the program in a memo 
to CBP. According to OCPO, CBP needed to address substantive issues in the acqui- 
sition plan. CBP should have had two separate H-60 plans, and both should move 
independently through the acquisition review process, including ARB review. OCPO 
was also concerned that CBP — 

• Had not clearly defined the acquisition’s period of performance; 

• Did not have a complete life-cycle cost estimate; 

• Had not completed a cost-benefit analysis to compare upgrading its existing 
fleet to purchasing new helicopters; and 

• Had not used various contracting best practices. 

Just 3 days after receiving the memo from OCPO, CBP nevertheless continued 
with the H-60 acquisition by signing an agreement with the U.S. Army. 

In March 2010, the ARB concluded that both CBP and the Coast Guard were pur- 
suing H-60 conversions and directed the Coast Guard to collaborate with CBP, re- 
port on possible helicopter program synergies, and present a joint review within 75 
days. The Coast Guard was not able to complete the review because CBP did not 
provide the needed information. 

Subsequent attempts to push the acquisition into the ALF failed. 

We recommended that DHS direct CBP to apply all ALF requirements to all its 
aviation-related acquisitions. DHS concurred with this recommendation, and CBP 
was directed to submit its plans to acquire aviation assets to PARM. According to 
DHS, the ARB would review and decide on CBP’s aviation programs and projects 
as they progressed through the ALF. 

Information Technology Investments 

In August 2012, we issued CBP Acquisition of Aviation Management Tracking 
System (Revised) (OIG-12-104). We reported that although CBP had a joint strategy 
to unify its aviation logistics and maintenance system with those of the Coast 
Guard, it planned to purchase a new, separate system. This system would not be 
coordinated with the Coast Guard’s already operational system. We concluded that 
the acquisition did not comply with the Secretary’s efforts to improve coordination 
and efficiencies among DHS components. Acquiring the new system would also be 
a continuation of components’ past practices of obtaining disparate systems that 
cannot share information. If CBP instead transitioned to the Coast Guard’s system, 
it would improve tracking of aviation management and cost less than purchasing 
a new system. 

DHS Governance of Aviation Assets 

DHS historically has had little formal structure to govern the Department’s avia- 
tion assets and no specific senior official to provide expert independent guidance on 
aviation issues to DHS senior management. The Department has intermittently 
issued policies and established various entities to oversee its aviation assets and op- 
erations, but it has not sustained these efforts. For example, DHS set up an Avia- 
tion Management Council in 2005, but oversight was inconsistent, and the council 
stopped meeting in 2007. In 2009, Department-level oversight of DHS’ aviation as- 
sets resumed. An Aviation Issue Team led by the Office of Program Analysis and 
Evaluation reviewed potentially co-locating component aviation facilities, finding 
commonality in component aviation assets, and combining component aviation-re- 
lated information technology systems. 

In 2011, the deputy secretary established an Aviation Working Group, but the 
group did not have a charter, defined roles and responsibilities, or an independent 
aviation expert. It collected data on CBP and USCG missions, aircraft inventories, 
flight hours, and aviation resources; reviewed components’ funding plans and oppor- 
tunities for joint acquisitions; and considered an organizational structure for a De- 
partment-wide aviation office. However, according to senior officials, without an au- 
thoritative expert, DHS was relying on unverified information from components to 
make aviation-related decisions. 

In addition to challenges in establishing a structure to govern aviation assets, 
DHS has had difficulty bringing aviation-related acquisitions into the ALF. For ex- 
ample, CBP’s Strategic Air and Marine Plan (STAMP) has an estimated life-cycle 
cost of about $1.5 billion. STAMP encompasses all of CBP’s aviation-related acquisi- 
tions used to detect, interdict, and prevent acts of terrorism near and across or 
across U.S. borders. CBP does not believe that STAMP should be subject to the ALF 
because the program existed before DHS established the framework. We contend 
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(and have recommended) that individual programs and projects under STAMP 
should go through the ALF separately. 

Unmanned Aircraft 

In CBP’s Use of Unmanned Aircraft Systems in the Nation’s Border Security 
(OIG-12-85, May 2012), we reported that CBP had not adequately planned the re- 
sources needed to support its unmanned aircraft. CBP’s plans to use the unmanned 
aircraft did not include processes to ensure that: (1) Each launch and recovery site 
had the required operational equipment; (2) stakeholders submitted mission re- 
quests; (3) mission requests were prioritized; and (4) it obtained reimbursement for 
missions flown on stakeholders’ behalf. Because these were not included, CBP risked 
having invested substantial resources in a program that underutilized resources and 
limited its ability to achieve its mission goals. Specifically, our audit showed that 
CBP had not achieved its scheduled or desired levels of flight hours for the un- 
manned aircraft. We estimated that 7 unmanned aircraft should support 10,662 
flight hours per year to meet the minimum capability and 13,328 flight hours to 
meet desired capability. However, staffing and equipment shortages, coupled with 
FAA and other restrictions, limited actual flight hours to 3,909 — 37 percent of the 
unmanned aircraft’s mission availability threshold and 29 percent of its mission 
availability objective. 

CBP’s Advanced Training Center Acquisition 

In February 2014, we issued U.S. Customs and Border Protection’s Advanced 
Training Center Acquisition (OIG-14-47). We reported that CBP did not effectively 
oversee and manage the fourth phase of the acquisition of its Advanced Training 
Center. Although not subject to the ALF, CBP did not comply with Federal and De- 
partmental regulations governing acquisitions. CBP did not develop and execute the 
$55.7 million agreement with its service provider, the U.S. Army Corps of Engi- 
neers, according to Federal, Departmental, and component requirements. In par- 
ticular, CBP did not develop, review, or approve a required independent Govern- 
ment cost estimate and acquisition plan prior to entering into the agreement. Key 
documentation supporting the agreement with the Corps of Engineers was either 
missing or incomplete. CBP also approved millions of dollars worth of contract modi- 
fications to the agreement without first ensuring the need and reasonableness of the 
modifications. In addition, CBP improperly used reimbursable work authorizations 
to transfer money for this project, as well as other construction projects. During our 
audit, CBP began taking action to ensure future compliance with all statutory re- 
quirements; CBP concurred with all our recommendations. 

TSA’s Advanced Imaging Technology 

We issued Transportation Security Administration’s Deployment and Use of Ad- 
vanced Imaging Technology (Revised) (OIG-13-120) in March 2014. We reported 
that the Transportation Security Administration (TSA) did not develop a com- 
prehensive deployment strategy for using advanced imaging technology (AIT) 
units — procured at a cost of nearly $150 million — at airports. Because TSA did not 
have reliable data to determine whether the units were effectively deployed, TSA 
decision makers could not implement efficiency improvements. 

This occurred because TSA did not have a policy or process requiring program of- 
fices to prepare strategic acquisition or deployment plans for new technology that 
aligned with the overall goals of the Passenger Screening Program. 

The AIT units did not undergo a stand-alone acquisition review, but were instead 
reviewed as part of the Passenger Screening Program. Because the AIT units met 
the Level 1 acquisition threshold, they should have gone through all the steps re- 
quired for that level. TSA should also have developed a deployment strategy for the 
Ait units, but it only developed a deployment schedule. 

Without documented, approved, and comprehensive plans, as well as accurate 
data on the use of AIT, TSA continued to screen the majority of passengers with 
walkthrough metal detectors. This potentially reduced AIT’s security benefits, and 
TSA may have used resources inefficiently to purchase and deploy AIT units that 
were underused. 


FAILING TO USE ACQUISITIONS TO FORGE “ONE DHS” 

In addition to failing to manage high-risk acquisitions through a governing proc- 
ess, DHS acquisitions often miss opportunities to ensure DHS acts in a concerted 
and efficient manner. DHS has struggled to become fully integrated. With 22 compo- 
nents and a range of missions, cooperation, and coordination continue to be a chal- 
lenge. The Department’s structure sometimes leads to “stovepiping” — components 
operating independently and management often not cooperating and sharing infer- 
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mation to benefit “One DHS.” In an April 2014 memorandum for DHS leadership, 
the Secretary reiterated the need to strengthen the Department’s “unity of effort.” 

During our recent audits, we identified several programs in which there was little 
or no cross-component coordination and communication and weak Department-level 
authority. These led to cost inefficiencies and ineffective program management. 
Therefore, we made recommendations to enhance collaboration to improve both effi- 
ciency and effectiveness and prevent waste and abuse. 

DHS Radio Equipment Program 

DHS manages about 197,000 pieces of radio equipment and 3,500 infrastructure 
sites, with a reported value of more than $1 billion. We issued a pair of reports that 
highlighted the problematic nature of some of the acquisition processes for commu- 
nications equipment. 

In one of our audits, DHS’ Oversight of Interoperable Communications (OIGr-13- 
06, November 2012), we tested DHS radios to determine whether DHS components 
could talk to each other in the event of a terrorist event or other emergency. They 
could not. Only 1 of 479 radio users we tested — or less than one-quarter of 1 per- 
cent — could access and use the specihed common channel to communicate. Further, 
of the 382 radios tested, only 20 percent (78) contained ah the correct program set- 
tings for the common channel. In other words, DHS components could not talk to 
each other using $430 million worth of radios purchased nearly a decade after the 
9/11 Commission highlighted the problem. They could not do so because DHS did 
not establish an effective governing structure with the authority and responsibility 
to ensure it achieved Department-wide, interoperable radio communications. We 
also reported that without an effective governing structure and a concerted effort 
to attain interoperability, the Department’s progress would remain limited. 

DHS’ plans to achieve interoperability are still in progress. The Department has 
drafted, but not hnalized, a DHS Communications Interoperability Plan; it has ex- 
tended the date of signature from April to September of this year. 

In August 2013, we issued DHS Needs to Manage Its Radio Communieation Pro- 
gram Better (OIG-13-113). We reported that without sound investment decisions on 
radio equipment and supporting infrastructure, DHS could not effectively manage 
its radio communication program. DHS had not implemented a governance struc- 
ture with authority to establish policy, budget and allocate resources, and hold com- 
ponents accountable for managing radio programs and related inventory. Compo- 
nents were still independently managing their current radio programs with no for- 
mal coordination with the Department. They used different systems to record and 
manage personal property inventory data, including radio equipment. The compo- 
nents’ inventory data also indicated they did not record radio equipment consist- 
ently in personal property systems. As a result, DHS was making management and 
investment decisions for the radio communication program using inconsistent, in- 
complete, and inaccurate real and personal property data. 

We concluded that a Department-wide inventory would help DHS prioritize its 
needs, plan its investments, and help plan future acquisitions and manage commu- 
nication networks. DHS also needs a strong governance structure over its radio com- 
munication program. Thus, we recommended that the Department develop a single 
portfolio for radio equipment and infrastructure and establish a Department-level 
point of accountability. In response to our recommendations, DHS said that because 
of budget constraints, it would include a time line and resources for portfolio man- 
agement in its hscal year 2016 Resource Allocation Plan. The Department was col- 
lecting data to develop a single prohle of assets, infrastructure, and services; review- 
ing existing policies and procedures; and planning to revise its personal property 
manual by June 30, 2014. 

Cross-Border Tunnel Program 

In our audit of GBP’s and U.S. Immigration and Customs Enforcement’s (ICE) ef- 
forts to monitor and detect illegal cross-border tunnels (CBP’s Strategy to Address 
Illicit Cross-Border Tunnels, OIG-12-132, September 2012), we reported that al- 
though CBP is creating a program to address capability gaps in countering the 
cross-border tunnel threat, it had not demonstrated how its detection strategy would 
consider ICE’s needs. 

CBP and ICE need coordination and oversight in developing these technologies be- 
cause the Border Patrol’s mission objective is to prevent illegal traffic from crossing 
the border while ICE’s objective is to investigate and dismantle criminal organiza- 
tions. 

Without taking into account both components’ needs, the Department risks not 
being able to disrupt criminal organizations that engage in cross-border smuggling. 
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We made recommendations to improve consideration of CBP’s and ICE’s needs and 
to improve DHS’ coordination and oversight of counter-tunnel efforts. 

CBP took action on our recommendations, including formation of an Integrated 
Product Team, which includes relevant stakeholders. It also planned to draft re- 
quired acquisition planning documents and submit the program to the ARB. 

Aviation 

Our audit of CBP’s H-60 helicopter program showed that CBP did not properly 
oversee and manage the conversion and modification of its H-60 helicopters, which 
affected the cost-effectiveness and timely delivery of the converted and modified 
H-60s. We noted that increased cooperation between CBP and the Coast Guard in 
managing the conversion and modification of its H-60 helicopters would reduce 
redundancies and potentially save millions of dollars. Specifically, if CBP were to 
complete the conversions and modifications at a Coast Guard facility, it would save 
about $126 million and H-60s would fly 7 years sooner. The Department’s own inde- 
pendent study confirmed that CBP would realize substantial savings by using the 
Coast Guard facility. Specifically, DHS estimated CBP could save at least $36 mil- 
lion and as much as $132 million in the cost of conversion alone. According to DHS, 
it could not be more precise because CBP did not provide sufficient data. 

Mr. Chairman, this concludes my prepared statement. I welcome any questions 
you or other Members of the committee may have. 

Appendix 

Major Management and Performance Challenges Facing the Department of Home- 
land Security, OIG— 14-17, December 2013 

Independent Auditors’ Report on DHS’ FY 2013 Financial Statements and Internal 

Control over Financial Reporting, OIG-14-18, December 2013 

DHS’ H-60 Helicopter Programs (Revised), OIG— 13-89, May 2013 

U.S. Customs and Border Protection’s Management of the Purchase and Storage of 

Steel in Support of the Secure Border Initiative, OIG— 12-05, November 2011 

Transportation Security Administration’s Deployment and Use of Advanced Imaging 

Technology, OIG— 13-120, March 2014 

DHS Needs to Manage Its Radio Communication Program Better, OIG— 13-113, Au- 
gust 2013 

United States Customs and Border Protection’s Radiation Portal Monitors at Sea- 
ports, OIG— 13-26, January 2013 

DHS’ Oversight of Interoperable Communications, OIG-13-06, November 2012 
CBP’s Strategy to Address Illicit Cross-Border Tunnels, OIG— 12-132, September 
2012 

CBP’s Use of Unmanned Aircraft Systems in the Nation’s Border Security, OIG— 12- 
86, May 2012 

Unclassified Summary of Information Handling and Sharing Prior to the April 15, 
2013 Boston Marathon Bombings, April 10, 2014 

DHS Uses Social Media to Enhance Information Sharing and Mission Operations, 
But Additional Oversight and Guidance Is Needed, OIG-13-115, September 2013 
DHS Can Make Improvements to Secure Industrial Control Systems, OIG-13-39, 
February 2013 

CBP’s and USCG’s Controls Over Exports Related to Foreign Military Sales, OIG— 

13- 118, September 2013 

U.S. Customs and Border Protection Has Taken Steps to Address Insider Threat but 
Challenges Remain, OIG— 13-118, Redacted, September 2013 

DHS Needs to Strengthen Information Technology Continuity and Contingency Plan- 
ning Capabilities, OIG— 13-110, Redacted, August 2013 

DHS Can Take Actions to Address its Additional Cybersecurity Responsibilities, 
OIG-13-95, June 2013 

DHS’ Efforts to Coordinate the Activities of Federal Cyber Operations Centers, OIG— 

14- 02, October 2013 

Homeland Security Information Network Improvements and Challenges, OIG— 13-98, 
June 2013 

Chairman McCaul. Thank you, Mr. Roth. 

The Chair now recognizes himself for 5 minutes. 

Mr. Mayorkas, let me first commend you for the clean audit, for 
getting more items off the high-risk list, for your efforts in DHS ac- 
quisition. The memo that came out recently by you and the Sec- 
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retary actually mirrors our legislation that we passed unanimously 
out of committee. So I do commend you for that. 

But I do have to raise an issue that happened last Thursday 
when the Secretary of Homeland Security placed the former acting 
inspector general, Mr. Edwards, under leave after a Senate report 
came out alleging among other things that Mr. Edwards inten- 
tionally changed and withheld information in some IG reports to 
accommodate the administration’s political appointees, and that he 
sought outside legal advice, compromising the IG’s independence. 

Now, I don’t know if these allegations are accurate. But if they 
are, this is the internal watchdog. This is sort-of like the old adage 
the fox guarding the henhouse. 

I know you are concerned about this, as I am. But can you tell 
me, has the Department launched an investigation into these alle- 
gations? 

Mr. Mayorkas. Thank you very much, Mr. Chairman. I would 
like to make two points in response to your very important ques- 
tion, one specific to the announcement to which you refer last 
Thursday. 

That is that the Secretary took swift and strong action in placing 
the former inspector general on administrative leave, and made the 
very important point that as additional facts are learned, appro- 
priate action will he taken. So this is a matter that is under proc- 
ess. I don’t think it would he appropriate for me to speak in more 
depth about a personnel matter. 

The overarching point that I would like to make is the following, 
and it is a very simple but a very important message. That is that 
the highest degree of ethics and integrity are conditions of employ- 
ment in the Department of Homeland Security. 

Chairman McCaul. So after this came out the Secretary placed 
him on administrative leave and the inspector general has been 
tasked to investigate the current inspector general, who is with us 
today. Is that correct or not? 

Mr. Mayorkas. I am actually not certain as to who is conducting 
that investigation, Mr. Chairman. Perhaps my colleagues here 
know. 

Chairman McCaul. Leads me to my next question. Mr. Roth, are 
you investigating these allegations? 

Mr. Roth. We are not. What we have is within the Inspector 
General Act a process by which allegations against either the in- 
spector general or people within reporting to the inspector general, 
allegations with regard to misconduct get investigated. 

There is the entity called the Committee of IGs for Integrity and 
Efficiency that has a special investigative committee. They have re- 
ceived a complaint — a series of complaints really, with regard to 
the former acting inspector general. 

That has now been farmed out to a different inspector general to 
ensure objectivity and you know to ensure that it is an independent 
and objective review of that. My understanding is that that inves- 
tigation is being conducted by the inspector general from the De- 
partment of Transportation. 

Chairman McCaul. Because these allegations are so serious the 
decision was made not to go with the IG within DHS, but rather 
farm it out to the IG at the Department of Transportation. 
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Mr. Roth. That is correct. Again, we followed the Inspector Gen- 
eral Act, which basically dictates how these things should work. 

Chairman McCaul. I mean does it concern you about these alle- 
gations involving allegations out of Cartagena with the Secret 
Service, or a report for $650,000 that was never disclosed on ac- 
countability and risk management? 

Mr. Roth. It deeply concerns me. Essentially the morning after 
I read the report I ordered that those reports be taken down from 
our public website. 

I have tasked a senior lawyer from our Office of General Counsel, 
that is our Office of General Counsel, not the Department’s Office 
of General Counsel, to conduct an internal investigation to talk to 
the career auditors who actually researched and wrote those re- 
ports to find out exactly what was changed, why it was changed, 
to restore those reports to its original condition and then repost it 
and report the results of it, not only to the committee but to the 
public. 

Chairman McCaul. Well, we look forward to hearing the results 
of that investigation. I also appreciate your testimony about the 
lack of interoperability at a 99.8 percent failure rate, which is as- 
tounding to me. 

The final question to Mr. Dodaro, and that is you mentioned in- 
formation sharing with respect to terrorism threats and cybersecu- 
rity, two issues very important to me and to this committee. After 
the Boston report have you done an analysis of the failure of infor- 
mation sharing? 

Mr. Dodaro. No, we have not been asked to take a look at that 
particular situation. 

Chairman McCaul. But you still mention that is high-risk in the 
DHS list. 

Mr. Dodaro. Oh yes, definitely. It looks at not only DHS but the 
five other — or four other agencies that are involved. It is a Govern- 
ment-wide high-risk designation in terms of information sharing. 

DHS is an important part of it. But we do look at the program 
manager at the DNI, the Director for National Intelligence, as well 
as the coordination with the Treasury and Justice and DHS. 

Chairman McCaul. Of course we know the inspector generals for 
the ICE and Department of Justice and DHS all came out with 
their report, which was, I think, a very candid assessment about 
what happened that day and what failed that day. 

With that, the Chairman now recognizes the Ranking Member. 

Mr. Thompson. Thank you, Mr. Chairman. 

Following that line of questions from the Chairman, Mr. Dodaro, 
do you foresee any time in the near future that DHS will get off 
the high-risk list? 

Mr. Dodaro. I think there is ample opportunity for continued 
progress. They need to meet the criteria for coming off the list, par- 
ticularly getting another year of a clean opinion on the financial 
statements, but also on internal controls. 

There is a statutory requirement that they have an opinion on 
internal controls, which is rather unique in the Federal Govern- 
ment, but nonetheless it is there and their current time frame for 
doing that and modernizing their financial systems is 2016 and be- 
yond. 
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They need to also demonstrate that they need to — that they can 
bring some of these acquisitions in within budget, scheduled on 
time and deliver a functionality that was originally intended by 
those acquisitions. 

So you know those are only two areas. I mean there are mile- 
stones within the other ones as well. So I think it is achievable in 
a relatively short-term, but it is going to take a while to actually 
produce these results. 

I am committed to working with the Department constructively. 
But I am not going to take anything off the high-risk list until the 
problems have been resolved. 

Mr. Thompson. Well, you referenced some material weaknesses 
within Coast Guard, FEMA, ICE, and CBP. What has been the re- 
sponse from those agencies when you shared those weaknesses 
with them? 

Mr. Dodaro. They have listened to what we have had to say. But 
there needs to be agreement not only in the Department — within 
the components, excuse me, but also at the Department-wide level. 

I mean part of the time that has been lost there in the financial 
management systems, which is what I was specifically talking 
about, is the Department pursued two efforts at least to have a De- 
partment-wide financial management system. Both of those efforts 
failed. Now they have tried to have a component-oriented approach 
to doing this, which can work, but it needs to have Department 
leadership. 

So we are going to be looking more carefully at this financial 
management modernization effort that they have under way. But 
it is still in its early stages. FEMA is the one that is furthest be- 
hind. 

Mr. Thompson. To the extent, Mr. Roth, you kind-of highlighted 
some of this in terms of the acquisitions and other things we have 
experienced within DHS. Explain what — you said that somehow 
DHS is in charge but that the components don’t follow the regula- 
tions. 

I think you were saying we have DHS up here and we have got 
these other people under here and the people down here kind-of do 
what they want to do. The people up top just kind-of observe them. 
So, who is really in charge? 

Mr. Roth. That is exactly the issue that we see. I mean right 
now the Department has something called the Acquisition Life- 
Cycle Framework, which is a, sort-of a framework that is there to 
ensure that acquisitions are well thought-out, that there are trigger 
points for review by high-level Department officials to ensure that 
we are spending money in the right way. 

It is a good program. It is run by the under secretary for man- 
agement in a group called the Program Accountability and Risk 
Management Section within the under secretary’s office. It works 
when it is used because it is deliberate. It is objective. It allows 
money to be spent in the right way. 

The difficulty is it was only set up in 2011. So you have some 
of these very high-dollar acquisitions. 

For example, the Customs’ Air and Marine program, basically 
the ships and the helicopters and the airplanes that Customs pur- 
chases, all high-risk acquisitions, all big-dollar acquisitions, some- 
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thing like $1.5 billion life-cycle costs for these things, are not part 
of that system because they pre-existed. 

What we believe ought to happen is that the leadership, the Sec- 
retary and the deputy secretary need to, candidly, be firmer with 
the components to ensure that these kinds of acquisitions get 
forced into the framework that DHS has set up. 

Mr. Thompson. I yield back. 

Chairman McCaul. Chairman recognizes Dr. Broun from Geor- 
gia. 

Mr. Broun. Thank you, Mr. Chairman. 

Let me wish Mr. Dodaro a happy birthday myself too. So I hope 
you have a great day, sir. It is a great way to spend it is with us. 

Mr. Dodaro. Well, I am ending it on the Senate. 

Mr. Broun. Well, I wish you well over there too. I think we are 
nicer than they are over there. 

But my first question to you guys is that we have, as Members 
of this committee, struggled with the jurisdiction issues. It seems 
to me that when any entity has multiple bosses then they have ab- 
solutely nobody in charge and no true boss. 

I am concerned about where we are going. We look at the high- 
risk issues and what is happening with acquisition and with cyber- 
security and with all the other areas that you all have brought for- 
ward as being problem areas. 

I will start with Mr. Dodaro. Would you comment as to the issue 
of jurisdiction? Is this — is jurisdictional problems part of why the 
DHS is struggling so much and has all these high-risk areas? If so, 
what would you recommend? How would you recommend to rectify 
that? 

Mr. Dodaro. I don’t believe jurisdictional issues are a factor in 
these high-risk designations, particularly with management func- 
tions within the Department. I think it is just a matter of the De- 
partment having to get the processes in place and execute properly. 

I mean in many cases they have the right policies in place. They 
are just not executing them appropriately. It is just a matter of the 
Department having to work more to provide guidance to the compo- 
nents and use the power of the purse, if you will, to not let them 
spend money unless they have approved baselines for acquisitions 
and they have done proper testing. 

I mean they shouldn’t be able to move forward without that. I 
mean the prescription for success in this area is very clear in fol- 
lowing best practices. But they are just not following it. 

You could — you know, the jurisdictional issues I don’t believe are 
at play here. It is just a manner of good management and follow- 
through and discipline. 

Mr. Broun. So this is a management problem then within the 
Department itself? 

Mr. Dodaro. Yes, for the management areas on the high-risk list 
definitely. 

Mr. Broun. How far up the chain does that go as far as manage- 
ment problems? 

Mr. Dodaro. Well, I think it goes to the highest levels in the 

Mr. Broun. As far as the Secretary? 

Mr. Dodaro. Yes. I think everybody has to be engaged. I think 
the Secretary’s memo that he just announced in April to have more 
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integrated planning and budgeting and requirements management 
and putting structures in place in the environment that work effec- 
tively would be a great step forward if they can get that done. 

Now, in the other areas in the cybersecurity and the information- 
sharing area, those are Government-wide high-risk areas. So the 
Department itself can’t address those issues. 

Theirs were I don’t think jurisdictional issues at play, but it re- 
quires broader oversight by the Congress because it is a Govern- 
ment-wide area. Those areas I think some joint hearings and some 
other efforts with other committees that have responsibility, and 
the House and Senate working together would be helpful, particu- 
larly in passing legislation, which we have called for to clarify 
DHS’s role and responsibilities as it relates to Federal oversight of 
computer security and critical infrastructure protection. 

There I think you need more parts of the Congress working to- 
gether to help DHS get the proper authorities in place. 

Mr. Broun. Well, you say it is a Government-wide problem and 
overall in some of those areas. But that is not an excuse though 
that one department, DHS, which we have jurisdiction over 
shouldn’t be solving that problem. Is that correct? 

Mr. Dodaro. Oh, that is absolutely correct. We have been look- 
ing at whether DHS even within the Department is sharing infor- 
mation. We have a report that will be coming out soon on the Of- 
fice of Intelligence Analysis as to whether or not DHS, within its 
own organization, is sharing information properly. That is exactly 
right. Congressman Broun. 

Mr. Broun. Mr. Roth, do you have any comment on acquisition 
just very quickly? I have got 30 seconds left to my time. So if you 
would be expeditious in your answer. 

Mr. Roth. I think Mr. Dodaro summed it up. We know what to 
do. We know the process that can be used to make smarter, better 
acquisitions. The question is forcing the components to follow that 
process. 

Mr. Broun. This is a long-standing problem. This is not just with 
this current Secretary or the past Secretary. It has been really ever 
since it has been stood up is my understanding. Is that correct? 

Mr. Roth. That is correct. Again, this process was only stood up 
in 2011 to try to integrate everything under the under secretary. 

Mr. Broun. Very good. Thank you, Mr. Chairman. My time is ex- 
pired. 

Chairman McCaul. Thank you. Just to follow up my colleague’s 
comments, when we are talking about jurisdiction though in the 
Congress, not within the Department but within the Congress, 
when the Secretary has to report to over 100 committees and sub- 
committees, doesn’t that detract from the core mission of protecting 
the American people, Mr. Dodaro? 

Mr. Dodaro. Well, we have not looked at that issue. But it is not 
uncommon in many departments and agencies for the Department 
of Defense, for example, to have multiple committees to report to. 

I think early on, and I am going back to the creation of the De- 
partment, there wasn’t enough transparency in working with the 
Congress and having open communication. That I think fostered a 
set of relationships that have to be overcome, and are being over- 
come over a period of time. 
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So I think if there was more transparency and the Department 
was actually producing the plans, the jurisdictional issues wouldn’t 
be as acute as they have been because of that I would say getting 
off on the wrong foot in its relationship with the Congress. 

Chairman McCaul. Well, again, this is not an issue I fault the 
Department on. I actually fault the Congress on this one because 
we can’t pass any legislation without multiple referrals to multiple 
committees. 

It becomes dysfunctional within the Congress. Then it takes time 
and attention away from senior leadership that need to be doing 
their job to report to over 100 committees and subcommittees. The 
Aspen Institute came out with a report talking about it. 

We need to — it was one of the top recommendations of the 9/11 
Commission was to have the DHS report to a single oversight com- 
mittee. That recommendation has never been followed by Congress. 
I think we need to change that. 

I am a little disappointed in the answer. I think Mr. Mayorkas 
may disagree with you on that. Do you? 

Mr. Mayorkas. Mr. Chairman, I think the Secretary has ad- 
dressed you and other Members of the Congress expressing his 
deep concern with respect to the jurisdictional issue and the posi- 
tion it places the Department in. 

Chairman McCaul. It detracts from the core mission. With that, 
the Chairman now recognizes Mr. Richmond from Louisiana. 

Mr. Richmond. Thank you, Mr. Chairman. 

Mr. Dodaro, now I want to talk about the National Flood Insur- 
ance Program. I see that you have made several comments or rec- 
ommendations regarding it. Do you have any concerns that their 
current capacity or these notations that you made will affect their 
implementation of the new Homeowner Flood Insurance Afford- 
ability Act? 

Mr. Dodaro. I think there are a number of recommendations 
that we have made, for example in modernizing their claims man- 
agement system that need to be put in place. The implementation 
of the Act will be a new challenge for them that could detract from 
some of the implementation of these recommendations. 

But I think it is very important for them to continue their efforts 
to modernize the claims system and oversee the contractors that 
write the policies for the Flood Insurance Program. 

Mr. Richmond. Well, that is exactly where I wanted to go be- 
cause you used the term the reasonableness of compensation to the 
insurance companies that sell and service most of the NFIP poli- 
cies. Do we think their compensation is on the unreasonable side 
in terms of high or low? Or is it something that we need to look 
into? 

Mr. Dodaro. You definitely need to look into that issue. I mean 
I think that that is an important question and that is something 
that we think requires more oversight and whether or not the com- 
pensation is appropriate. 

Mr. Richmond. Our numbers, and I don’t know if your numbers 
would say the same things, in that through the life of the Flood In- 
surance Program that the amount of money in premiums that have 
gone in almost equals the amount of money that is going out, ex- 
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cept that you have all the administrative expenses that any insur- 
ance company would have. 

But everywhere we can reduce those administrative costs or the 
costs that the insurance companies are charging for either serv- 
icing or the commissions that they receive, we make the program 
more stable. We can directly save the taxpayers money on those. 
Have you looked at 

Mr. Dodaro. Yes. I think the administrative costs need to be 
under constant review to make sure that they are at the minimum 
necessary to operate the program. However, the premiums in our 
opinion have not been sufficient to cover the costs of the programs. 

I mean currently the National Flood Insurance Program owes the 
Treasury $24 billion and hasn’t made a principal payment since 
2010 on that issue. So it is not really actuarially sound going into 
the future. So that is one of the reasons it is on the high-risk list. 

Mr. Richmond. Right. I don’t think that we will ever get to actu- 
arially sound and maintain a sense of affordability for the 5 million 
homeowners who participate in the program. 

But I think the goal should be that where we can save money 
we should save money. Where we can be more efficient we should 
be more efficient. So that is my concern when we talk about the 
efficiency of the management of the program and making sure that 
the people who service the program are being as efficient, and we 
are very diligent in terms of what we are paying them. 

So the other thing you mentioned was the debt management and 
how that could offer us some cost savings. 

Mr. Dodaro. Well, I think it is important that they figure out 
how to both build a reserve for the future potential cost, but also 
how to figure out how to repay the Treasury Department for the 
amount of money that they owe. That is going to be a tall order 
for them given the current statutory framework on which they 
have to operate under. 

So I think additional action will be needed by the Congress to 
help them in order to put the program on a firmer financial footing. 

Mr. Richmond. Then I guess we can have the whole philo- 
sophical debate. But we have to get it on firm financial footing. But 
actuarial rates is probably not the way to do it considering that 
many of these homes were built before there was a requirement for 
flood insurance. To go back and change it in our area we saw rates 
increasing from $500 and $600 to $10,000 a year, which will cause 
another mortgage collapse and all of those things. 

Mr. Dodaro. So I agree with you. I think — I mean there has to 
be a balance between affordability and fiscal responsibility and ac- 
countability and in this case transparency because if the home- 
owners aren’t paying for the insurance that means the general tax- 
payers are. It is not really clear what the subsidies are. I am par- 
ticularly concerned about the future. 

We have put also on the high-risk list limiting the Federal Gov- 
ernment’s exposure by better managing climate change risks. With 
the potential for climate change and other additional issues in the 
offing, I mean this program is one that requires I think constant 
scrutiny and more transparency about who is paying for what in 
the program. 

But I agree with you, affordability has to be a policy priority. 
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Mr. Richmond. Mr. Chairman, I see my time is expired. I was 
just going to ask Mr. Mayorkas if he had a response. I am not re- 
quiring one. 

Mr. Mayorkas. I do not. I do not, Mr. Congressman. 

Mr. Richmond. Thank you, Mr. Chairman. Yield back. 

Mr. Mayorkas. Mr. Chairman, may I make a point if I may, 
even though there is no question pending to me I feel compelled to 
share something with the committee because my colleagues have 
expressed concern that components do not necessarily follow the di- 
rection that a best practice would require to address a management 
challenge. 

I think it is very important to communicate to this committee 
very clearly to ensure that there is no misimpression that the com- 
ponents are willfully disobeying guidance. It is not an issue of that. 
But it is rather an issue of putting the structures and the mecha- 
nisms in place to drive everyone in the same direction and to en- 
sure a disciplined and rigorous adherence to best practices. It is 
really a matter of accountability. 

I know there was a reference made that we don’t have appro- 
priate accountability mechanisms in place, and I would respectfully 
disagree with that. Quite frankly, if there is a failure of a compo- 
nent to adhere to a best practice in the service of addressing a 
management challenge, I am ultimately accountable for that. 

Of course the Secretary is. But I am overseeing the management 
of the Department on behalf of the Secretary, and that account- 
ability regime rests with me. 

Chairman McCaul. Well, I appreciate you taking responsibility 
for that. I hope to see some good results. 

Chairman recognizes Mr. Duncan. 

Mr. Duncan. Thank you. Chairman, for this valuable hearing 
today. I want to thank the panelists for the comments that they 
made about H.R. 4228 and the acquisition reform bill. 

You know the goal is to improve discipline accountability and 
transparency and acquisition program management and a lot of 
things that I am hearing on all the topics today come down to just 
those basic disciplines of doing best practices and all of the acquisi- 
tion reform. 

So I heard Secretary — I mean Comptroller Dodaro say this. But 
deputy secretary, have you had a chance to review H.R. 4228? 

Mr. Mayorkas. I have, sir. 

Mr. Duncan. Okay. Do you believe it will aid DHS in addressing 
acquisition management challenges? 

Mr. Mayorkas. I do, sir. I should inform you and this committee 
that in reviewing the proposed legislation that this committee 
passed I have drawn some practices that we should adopt and not 
await the passage of the legislation. 

Mr. Duncan. Thank you. I agree. Whether we have to have Con- 
gressional legislation passed or not it is the right thing for the De- 
partment to do. I think the Secretary agrees with us as well. So 
thanks for saying that. 

With the most recent GAO high-risk report citing the Depart- 
ment’s continued management challenges, and with our country 
being $17.5 trillion in debt, do you think it is wise for DHS to con- 
tinue to spend scarce spending on unnecessary green initiatives 
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and costly renovations on a project such as St. Elizabeth’s that 
won’t be complete until 2026, and will cost the American taxpayer 
about $4.5 billion or more, deputy secretary? 

Mr. Mayorkas. Mr. Congressman, as a general principle of 
course no expenditure of funds should be permitted that does not 
yield an effective and efficient delivery of service on behalf of the 
American people. 

The Secretary is reviewing the St. Elizabeths project, and we are 
as a Department with all components involved taking a look at 
what our resource investment should be in light of the cost and our 
current budget environment. It was as recently as yesterday that 
all the components met with the Secretary and me on that very 
subject. 

Mr. Duncan. Well, I think that is great. I appreciate the Sec- 
retary reviewing that. I just don’t believe that — ^you know in a uto- 
pian society rainwater flush toilets are awesome. 

But when you are $17.5 trillion in debt and you are accountable 
to every taxpayer dollar, I think you need to start questioning that 
and maybe the use of the hardest wood from Brazil for the decking 
when you could use a composite material that will last just as long 
and save the taxpayer dollars. So I appreciate your efforts and I 
look forward to that. 

I ask the comptroller general about St. Elizabeths and the cost 
overruns. I know GAO has looked at that. Do you care to comment 
on saving taxpayer dollars and that? 

Mr. Dodaro. Well, certainly we support the effort to do any pro- 
gram activity at the least cost possible. We are currently looking 
at the St. Elizabeths situation and we will be happy to share our 
report with this committee as soon as it is complete. 

Mr. Duncan. We look forward to that as well. 

So deputy secretary, given the large number of programs still 
lacking Department-approved documents and experiencing cost 
overruns and schedule delays, what do you believe is the biggest 
challenge with regard to the high-risk list, the biggest challenge in 
doing effective oversight of DHS major acquisition programs? 

Throw out some challenges that you have got. There might be 
another nugget in there that we can pursue from the Congressional 
side. 

Mr. Mayorkas. Thank you, Mr. Congressman. I think that my 
colleagues Mr. Dodaro and Mr. Roth have identified issues with re- 
spect to our acquisition program. 

The Secretary, through the Unity of Effort memorandum that he 
issued, to which the Chairman referenced, puts in place a structure 
to drive better acquisition oversight and management. I lead under 
the Unity of Effort, a paradigm, I lead the deputy’s Management 
Action Group where we are all — components and headquarters — to- 
gether in ensuring that capabilities are identified, the needs are 
properly identified. 

The gaps are therefore disclosed. We don’t close those gaps with- 
out establishing effective requirements, understanding our budget 
constraints, being effective and efficient in the use of our money, 
and ensuring that the delivery of service takes all of those factors 
into account. 
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Mr. Duncan. I am about out of time. I will say that hearings like 
this are refreshing. 

What I am hearing from all the gentlemen is that it seems that 
the Department is moving in the right direction. I would attribute 
the Chairman’s leadership and this committee for helping nudge 
the Department in the right direction with regard to acquisition 
management and addressing a lot of the concerns that were 
brought about by the gentleman from Louisiana and the gentleman 
from Georgia. 

So I want to applaud the Department for continuing to move in 
that direction. I can tell you we are going to be right behind you 
to make sure that the trend continues. 

With that, Chairman, I yield back. 

Chairman McCaul. We also commend your leadership as Chair- 
man of the Oversight Subcommittee. You have done a fantastic job. 

Chairman recognizes Mr. O’Rourke from Texas. 

Mr. O’Rourke. Thank you, Mr. Chairman. I would like to 
present the panel with two current acquisition projects and then 
get your comments. 

The first is one that we had a hearing on within the last month, 
the Arizona Border Surveillance Technology Plan, which essentially 
would spend between $500 million to $700 million to put a series 
of fixed towers along the Arizona-Mexico border with a high-tech 
surveillance system there, obviously to try to apprehend people 
who might cross into the country illegally. 

This is on the heels of the failed SBInet program that spent a 
billion dollars and achieved almost nothing at great taxpayer cost 
and Government waste. In that hearing we learned from someone 
on your team at the GAO that there were several significant find- 
ings that the GAO had made, including no clear metrics and no 
clear life-cycle costs for that program. So that is one that comes to 
mind. 

The second in El Paso, Texas is a half-mile stretch of currently 
unfenced border between El Paso and Juarez, an area where in the 
last 4 years without there being a fence total crossings have 
dropped year after year and they are at a fraction of what they 
were even 4 or 5 years ago. 

It is also a very historical crossing point. DonJuan De Onate in 
the 16th Century crossed there. 

The sensitivity is so great that not only have I but the other Con- 
gressman representing the area, one of our U.S. Senators, the city 
council, the State senators, the State delegation have all pleaded 
with CBP not to construct that wall there at a cost of $5.5 million. 
But we were told by the acting commissioner at the time that the 
wheel is already in motion and it is too hard to stop this. 

So with those two examples my question is: When is it an appro- 
priate time to put on the brakes? I would think that those major 
findings that the GAO made after the failure of SBInet we should 
stop before proceeding with this Arizona Border Surveillance Tech- 
nology Initiative. 

The $5.5 million in El Paso may not sound like a lot, but $5.5 
million here, $5.5 million there soon it adds up and becomes real 
money. So I would like to get your thoughts on how we get greater 
control on spending when there are findings, when there are con- 
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cerns raised by this committee or the GAO, when it might be ap- 
propriate to pause and rethink some of those projects. 

Mr. Mayorkas, we will start with you. 

Mr. Mayorkas. Thank you very much, Congressman. I have, in 
the short time that I have been in office I have visited the Texas- 
Mexico border as well as the Arizona-Mexico border. I will tell you 
that visiting — there is no substitute for visiting the border because 
one understands first-hand the challenges that it presents. 

The lesson that I learned there is certainly it is not a one-size- 
fits-all model. There have to be different technological and oper- 
ational solutions to address the very different and very diverse 
challenges that the Southwest Border presents. 

You ask a very fact-specific question, which is: When is it right 
to pull out of a project when the project isn’t going well? I think 
that 

Mr. O’Rourke. Not just pausing the project. We could use Ari- 
zona — the border surveillance plan there. Would it not make sense 
for DHS to stop spending until those GAO concerns are resolved? 

Mr. Mayorkas. Congressman, as a general matter I find it un- 
tenable to continue to pour money into a project when one doesn’t 
have a level of confidence in the effectiveness and efficiency of the 
undertaking. So that is a general principle. 

In fact we have executed on that general principle over the last 
few months. We have paused. We have suspended discrete projects 
because we have not had confidence in the stability of the under- 
taking. 

So there is no shyness. There is no hesitation to do that in order 
to make sure that we do not develop something that is ineffective 
by the time it is deployed 

Mr. O’Rourke. Right. 

Mr. Mayorkas [continuing]. And we create more work for our 
oversight 

Mr. O’Rourke. Sorry to interrupt, but I have little time left. You 
have paused in other projects. Will you pause in this project? 

Mr. Mayorkas. I — as I sit here today, Mr. Congressman, I am 
not aware of a reason why the Integrated Fixed Towers Project 
should be paused. I will tell you that is 

Mr. O’Rourke. I gave you two. 

Mr. Mayorkas. I will have to look into the second one, which is 
the wall that 

Mr. O’Rourke. I gave you two reasons on that Arizona Border 
Surveillance. No life-cycle costs and no clear metrics for what that 
is supposed to achieve after spending up to $700 million. 

Could I hear from Mr. Dodaro on this and Mr. Roth if there is 
time? 

Mr. Dodaro. Yes. Our report focused on the fact their cost esti- 
mates and the schedule estimates weren’t complete or reliable. 
There was limited testing planned on there as well as the fact that 
there weren’t metrics tying it to the particular problem. 

The Department agreed with most of the recommendations. Ex- 
cept I was disappointed they didn’t agree to do more testing on 
this. I think this is important given the past history and some of 
those other activities. 
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So I think it is important that these issues be addressed before 
they proceed into full-scale production. 

Mr. O’Rourke. If the Chairman will allow, I would love to hear 
from Mr. Roth on this, if you have any comments. 

Mr. Roth. Yes. The entire life-cycle — acquisition life-cycle frame- 
work requires in fact certain stopping points where an examination 
is done by independent senior leadership to ensure that it should 
go forward in a timely way or in a rational way. 

So there are stop points all the way along, and it is perfectly ap- 
propriate during an acquisition to hold off and address concerns. 

Mr. O’Rourke. Okay. Thank you. 

Thank you, Mr. Chairman. 

Chairman McCaul. Chairman recognizes Mr. Sanford from 
South Carolina. 

Mr. Sanford. I thank the Chairman. I apologize for getting here 
late. So I did not get to hear the entirety of your testimony. I was 
caught up in another meeting. 

But I jotted in a note in looking at preliminary brief. There was 
a GAO report that said, DHS could better manage its portfolio, ad- 
dress funding gaps and improve communication with Congress. 

One of the findings was basically that there was a gap between 
acquisition of programs and the overall Homeland Security strat- 
egy. That at several different junctures this gap was seen between 
acquisition and strategy. 

I have got a quote here. I am beginning to lose my eyesight. But 
it says “GAO goes on to say in its report that none of the reports 
that DHS put out consistently identified how individual acquisition 
programs would help DHS to achieve its goals.” Then there is some 
more verbiage from there. 

So I guess I would turn to the GAO, to you, Mr. Dodaro. 
Thoughts on that? What else did you see with regard to this gap 
between a time strategy and individual acquisition programs? 

Mr. Dodaro. There really are two types of gaps. One is the one 
that you mentioned. But the second is a funding gap issue in terms 
of whether or not you have enough money there. I mentioned ear- 
lier in my opening statement that of the major acquisitions, 46% 
don’t have approved baseline costs and 77% don’t have life-cycle 
costs. 

Now, even with that limitation the Department undertook an ef- 
fort a year or 2 ago to identify what the gap would be if all these 
acquisitions would cost certain amount of money and the Depart- 
ment had certain amount of resources. They have figured that 
there was 30% gap between what these acquisitions will cost and 
what they were likely going to have money for, which means they 
need to set priorities. 

Of course in setting priorities you have to go with what your 
overall strategies are and what kind of priorities are in your strat- 
egy. So they need a governance structure at the Department to set 
these priorities across the Department because they are not going 
to have, you know, enough money to be able to deal with these 
issues. 

This is a similar issue we brought to the Department of Defense’s 
attention. It will particularly be true if sequestration resumes in 
2016 through 2022. 
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So it is very important that they deal with this. I know they have 
some plans to do it. But they are in the very early stages. 

Mr. Sanford. Couldn’t it he said of pretty much any Government 
agency that there is always a gap between what they would like 
to have and what they would get? I mean so isn’t that 

Mr. Dodaro. Well 

Mr. Sanford. I mean it may 

Mr. Dodaro. Well, but 

Mr. Sanford [continuing]. The issue within Homeland Security 
or DOD, but 

Mr. Dodaro. Right. 

Mr. Sanford [continuing]. That seems to be a consistent refrain. 

Mr. Dodaro. Well, there is a difference between what you — how 
much money you are going to have and what you would like to 
have a lot of money, as opposed to how many projects you have al- 
ready started down the road that you are not going to be able to 
complete. 

That is a different situation. I am saying in that case they are 
spending money to get these projects up and running, and they are 
not going to have enough to finish, the money, so that those 
projects that aren’t finished will be not optimal use of the tax- 
payers’ money. 

As opposed to, we are not going to have this amount of money, 
here is the priority we want to do. We need to stop this acquisition 
or we need to redirect our funds to other areas. 

So it is very important to do that, particularly given the rather 
poor track record that they have in delivering their acquisitions 
with functionality, within cost and on time. 

Mr. Sanford. If you were just waving a magic wand and as you 
look at this agency in particular, are there other things that per- 
haps didn’t make your report but things that entered your mind? 
Or that you all evaluated but found too controversial and maybe 
left off, where you would say this is an area of opportunity that 
Homeland Security ought to look at in terms of better optimizing 
taxpayer dollar in maybe a way that they aren’t? 

Mr. Dodaro. No. I think our report is pretty complete. I mean 
we put everything out there that we have identified. 

Since the Department has been created we have made over 2,000 
recommendations to the Department. About 65% of them they have 
implemented. They have efforts underway in other areas to imple- 
ment. 

So we — I think we have been pretty thorough in pointing out all 
the major areas that need attention. 

Mr. Sanford. I suspect you might have a counterpoint to some 
of this and I therefore would offer the floor to you in the few sec- 
onds that I have got left. 

Mr. Mayorkas. Congressman, I think I actually will not have a 
counterpoint. I think, quite frankly, that the work of Mr. Dodaro 
and his team has helped make us better, and identified gaps that 
we need to fill. I think I can say the same for the work of Mr. Roth 
and his team. 

You used the word opportunity. Fortunately I am an optimist 
and so I look at the challenges we have as opportunities, opportuni- 
ties to be better. 
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Mr. Dodaro referred to the fact that a governance structure pre- 
sents some hope, some cause for optimism, but it is at the nascent 
stage. That is true. 

Both the Secretary and I are new. The Secretary has put in place 
a governance structure and we will drive to achieve its aspiration. 

Mr. Sanford. I burned through my time. Thank you, Mr. Chair- 
man. Yield back. 

Chairman McCaul. Chairman recognizes Mr. Payne. 

Mr. Payne. Thank you, Mr. Chairman. 

Mr. Roth, you know the findings in the November 2012 IG report 
on interoperable communications at DHS are very concerning. I 
have introduced legislation to DHS Interoperable Communications 
Act that aims to address the problems, you know, related to the 
Government structure and strategy identified in the report. 

In your testimony you mentioned that the Department has devel- 
oped but not finalized DHS Communications and Interoperability 
Plan. Have you seen drafts of this plan? 

Mr. Roth. I have. 

Mr. Payne. Okay. What do you think to this point? 

Mr. Roth. We made our primary recommendation after doing the 
audit that had the 99.8% failure rate, was that there ought to be 
an interagency structure that had an individual or group with true 
power to be able to require the components to get interoperable 
systems. 

The Department, inexplicably in my mind, non-concurred with 
that, and instead went forward with what we consider to be a less- 
er proposal requiring essentially cooperation among the compo- 
nents. 

We think that is the wrong way to go. We think showing strong 
leadership is the way to go, and essentially forcing compliance by 
the components. 

Mr. Payne. Yes. Well, you know it is clear based on information 
I have that this legislation, you know, is crucial to finally get De- 
partment-wide interoperability. 

I was shocked to hear that in your testimony, you know in your 
test case, only 1 out of 479 first responders were able to get on a 
common channel. You know 1 out of 479. 

What is it going to take to achieve interoperability? As you say, 
the Department is obviously not following recommendations that 
have been made. That you say have decided to go with a lesser 
plan. What is it going to take to get to interoperability? 

Mr. Roth. Well, certainly hearings like this I think highlight the 
problem. Accountability by this committee and other committees 
and the American people to ensure that the purposes behind DHS, 
which was to have all these disparate agencies under one roof so 
they could in fact talk to each other is a good thing. 

But again, it is a promise that has not yet been kept. 

Mr. Payne. Okay. You said many didn’t even know that the com- 
mon channel existed. Is it going to take more training or as you 
said more hearings like this and a concerted effort on us to push 
them in that direction? 

Mr. Roth. To be fair, this test took place in 2012 before the cur- 
rent administration within DHS was appointed. We are hearing 
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good things from the Secretary and the deputy secretary with re- 
gard to unity of effort. 

I am optimistic that we can get there. But I am frankly con- 
cerned that as we speak today a Secret Service agent in New York 
can’t get on his radio and talk to a Federal Protective Service offi- 
cer in New York or a CBP officer in El Paso can’t talk to a Home- 
land Security Investigations Agent in the same city. 

Mr. Payne. Okay. 

Thank you, Mr. Chairman. I yield back. 

Chairman McCaul. Let me just state for the record, Mr. Payne, 
your bill on interoperability will be part of our mark-up in May 
coming up soon. So we thank you for that. 

Chairman now recognizes the gentlelady from New York, Ms. 
Clarke. 

Ms. Clarke. Thank you, Mr. Chairman. Thank you. Ranking 
Member. 

My first question is to you, Mr. Mayorkas. I want to talk about 
the Department’s transition to a large portion of its information 
technology to the cloud, and a couple of questions with regard to 
that. 

Does the CIO work with the Department cybersecurity and pri- 
vacy experts to ensure that proper protections are in place for 
cloud-based technologies? How does this improve efficiency? 

Do you anticipate this move to the cloud resulting in cost sav- 
ings? What steps are being taken to ensure that the private cloud 
utilized by the Department is secure? 

Mr. Mayorkas. Thank you very much. Congresswoman, for the 
question. The answer is yes. 

The head of information technology, Luke McCormack, does work 
very closely with our NPPD, our directorate, and Susanne 
Spaulding. It is made to ensure that the use of the cloud passes 
cyber-hygiene, if you will. 

What the cloud provides is the ability for the Department to es- 
sentially pull on an as-needed basis certain technological capabili- 
ties. So with that nimbleness and surgical use of IT not only do we 
gain effectiveness, but we also gain cost savings. 

Ms. Clarke. Well, there has been a lot of talk here on the Hill. 
We have turned our attention to immigration reform and proposals 
such as the DREAM Act may create a pathway for many millions 
of youngsters becoming American citizens. This could create a 
major influx of applications coming to the USCIS system. 

Would the limitations of current paper-based system that I am 
sure you know all too well, how will USCIS handle this increased 
caseload? Are there any activities underway at the headquarters 
level to address this impending issue? 

Mr. Mayorkas. Thank you very much for that question. Con- 
gresswoman. We of course remain committed to comprehensive im- 
migration reform. I think there are two streams of activity that are 
responsive to your question. 

One is to develop the technological capabilities to accept a large 
influx of new applicants in an electronic or on-line environment. 
That effort is under way. It is a very significant and challenging 
effort, but we are making progress in it. It is called transformation 
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to move from a paper-based agency to an on-line environment on 
the one hand. 

On the other hand, U.S. Citizenship and Immigration Services, 
which I was very proud to be a part of for 4 years, is extraor- 
dinarily adept at handling surges in the number of individuals 
coming before it. It has exhibited that nimbleness and that adept- 
ness in the last 2 years in taking on a huge surge in previously un- 
anticipated applicants. 

Ms. Clarke. So you believe that the transformative nature of the 
new technologies that you are currently sort-of testing would be 
able to manage potentially, you know, tens of thousands if not mil- 
lions of individuals seeking to apply for — through for immigration 
reform and the personnel commensurate with that is sort-of trained 
and gearing up as well? 

Mr. Mayorkas. Congresswoman, the goal of transformation is to 
be able to do that. We are working towards that. It is a challenging 
undertaking, but we are working towards that on the one hand. 

On the other hand, to be able to address an increase in applica- 
tions of, for example, 11.5 million people, there is an infrastructure 
that needs to be built. We have communicated very clearly to the 
bipartisan committee that passed the Senate bill last year. 

They understood and legislated accordingly that there needs to 
be some ramp-up time so that the agency could in fact build the 
infrastructure to take on that significant new workload. But not 
just personnel, but facilities, IT infrastructure and the like, but we 
are prepared with time and funding to meet that challenge. 

Ms. Clarke. Very well. Then I just wanted to quickly — my time 
is winding down — talk about disciplinary practices. There are a lot 
of folks who believe that there are some — it is inequitable and of- 
tentimes arbitrary. 

For example, there is no Department-wide standard for penalties. 
The same offense can engender different results without any sound 
reason for this discrepancy. 

Would you agree that the Department could benefit from stand- 
ardized disciplinary processes? How not having these processes in 
place can have an impact on low morale, for instance? 

Is a Department-wide standard for penalties under consider- 
ation? If not, why? 

Mr. Mayorkas. That is a very interesting question. Congress- 
woman. When I was the director of U.S. Citizenship and Immigra- 
tion Services, we actually had that infirmity within the agency that 
we did not have really a cohesive and consistent discipline regime, 
and we implemented one during the course of my tenure. 

Whether there should be a Department-wide standard is a ques- 
tion that I would actually like to give thought to because I will tell 
you that there are different dynamics at play within each compo- 
nent of the Department. There are different unions, union leader- 
ship, union relationships. 

I think at a general level my immediate reaction is that we 
should have standardized processes and we should have consist- 
ency in the response — in the disciplinary response to similar behav- 
iors. I would like to actually give further study, and quite frankly 
speak with my colleagues here to my left with respect to your ques- 
tion. 
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Ms. Clarke. My time is run out, but if the Chairman gives an- 
other round, we will 

Chairman McCaul. Well, if you would like to hear other wit- 
nesses — 

Ms. Clarke. Oh, certainly. 

Chairman McCaul. This is our final round. 

Ms. Clarke. Okay. Thank you, Mr. Chairman. 

Well then, gentlemen, would you please give me your opinion on 
these disciplinary actions? 

Mr. Roth. Thank you. We have not done an audit with regard 
to this except with the Secret Service, which did not have a table 
of penalties. We found that that was a problematic issue with re- 
gard to some of the issues that occurred in the Secret Service. 

I think I would join Mr. Mayorkas in indicating that that is a 
broader issue that we would probably need to study in a more 
thoughtful way. 

Mr. Dodaro. Yes. We have looked recently at TSA employee mis- 
conduct issues and how that is handled. I would be happy to pro- 
vide that for the record and any other thoughts that we have on 
this matter. 

Ms. Clarke. Very well. I appreciate that, gentlemen. Thank you 
all for your testimony here today. 

Thank you, Mr. Chairman. I yield back. 

Chairman McCaul. Thank you. I want to thank the witnesses. 

Chairman recognizes the Ranking Member. 

Mr. Thompson. I just want to thank the Chairman for this hear- 
ing and the witnesses for their candid comments in response to the 
questions. 

The thing that continues to bother me, though, is we put the De- 
partment of Homeland Security under one roof. But it just appears 
that there are some outliers within the Department that continue 
to do as they please. 

We have reports after reports that continue to highlight those do- 
as-you-please efforts that cost money. What I have taken away is 
that you continue to highlight it, but somehow it doesn’t get imple- 
mented. 

I guess I am struggling for — can you, each one of you witnesses 
provide us in writing what you think it would take for the Depart- 
ment to run seamlessly, all the components within DHS using one 
standard for procurement and other things? 

Right now procurement, personnel, a lot of issues continue to be 
different. I think if we have One DHS, if we have this now Unity 
of Effort approach, how can we actually accomplish that if we still 
have Coast Guard, FEMA, CBP, ICE kind-of doing what they want 
to do? I am just kind-of concerned about that, that we should just 
have a standard system. 

Now, obviously there are some exceptions. But I think those ex- 
ceptions can be noted. But I would like to see something from our 
witnesses since they have been so good that could help give this 
committee some direction on how we can come up with one system, 
whether it is IT system or whatever, in those categories that have 
been outlined. 

I yield back. 
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Chairman McCaul. I concur with the Ranking Member. We 
would like to see that, if you could respond maybe in writing after 
the hearing. 

I know Ms. Clarke and I have worked on the iCloud concept in 
terms of bringing the One DHS together. I think that is an inter- 
esting concept as well. 

I did have one last question for Mr. Roth. The Secret Service has 
mentioned, know you are reviewing your predecessor’s report, the 
allegations involving drunkenness during Presidential protection. 
Very serious concern on the part of this committee that that con- 
duct is still on-going within Secret Service. 

I know you are reviewing those currently. When do you antici- 
pate that your report will come out? 

Mr. Roth. We are looking at the current reports. We are not en- 
gaged in a further audit or inspection of that. But what we are 
doing is in light of the Senate subcommittee’s report we are looking 
to ensure that any of the conclusions within the report were un- 
tainted by any sort-of political or other improper considerations. 

We are doing that as expeditiously as possible, but we want to 
get it right. I am hopeful in the next few weeks we will be able 
to get it out. But right now I can’t give you 

Chairman McCaul. Will you be providing any guidance to the di- 
rector of the Secret Service in terms of — ^you mentioned there are 
no real sort of disciplinary procedures in place. 

Mr. Roth. At the time of our audit there were no disciplinary 
procedures. There were no tables of penalties. That has been fixed. 

In the series of audits we did, we did a look-back to see what the 
internal investigation looked like. We also did what was known as 
the so-called culture report. 

In the culture report we had a series of recommendations that 
we asked the Secret Service to do. They are in the process of com- 
plying with each of those. I am happy to give a interim report as 
to, sort-of, how they are doing with regard to responding to our rec- 
ommendations. 

Chairman McCaul. I would appreciate that. Protecting the 
President is one of the highest duties 

Mr. Roth. Yes. 

Chairman McCaul [continuing]. Within the Department. 

So we thank the witnesses for testifying here today. The record 
will be open for 10 days. You may have additional questions. With 
that, without objection, committee stands adjourned. 

[Whereupon, at 11:31 a.m., the committee was adjourned.] 
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Questions From Chairman Michael T. McCaul for Alejandro N. Mayoekas 

Question 1. According to a December 2013 GAO report, CBP and ICE continue 
to struggle with large portions of their TECS modernization which could result in 
cost overruns and delay its 2015 deployment deadline. TECS is critical to the De- 
partment’s border security and law enforcement missions. Describe the management 
direction you are providing this project and please give the committee an update on 
the TECS modernization efforts and whether or not ICE and CBP will deliver its 
planned functionality by 2015 as originally scheduled. 

Answer. DHS has a tiered governance structure that includes oversight at the 
senior leadership level, the component level, and the program level. At the highest 
level, the Department is actively monitoring both programs by way of Executive 
Steering Committee (ESC) meetings made up of senior-level executives, including 
Headquarters and Component Chief Information Officers, Chief Acquisition Execu- 
tives, and Chief Financial Officers. Executive Steering Committees are decision- 
making bodies that provide governance and oversight for all of the Department’s IT 
Major investments. 

Currently, due to the program’s high risk, the U.S. Immigration and Customs En- 
forcement (ICE) TECS Modernization has a monthly ESC meeting and bi-weekly 
deep-dive meetings with the Department’s Chief Information Officer and manage- 
ment acquisition team. The U.S. Customs and Border Protection (CBP) TECS Mod- 
ernization has bi-monthly ESC meetings. 

The CBP TECS Modernization has been deploying modernized functionality incre- 
mentally since 2009 and is on track to deliver the majority of modernized capability 
by September 2015, as originally planned. This program has multiple releases of 
which 80% have been delivered. The remaining 20% will be delivered on schedule 
hy September 2015. 

The ICE TECS Modernization is in the technical evaluation phase of procuring 
an application vendor, with an anticipated award in September 2014. The program 
is currently a high-risk program due to its schedule and cost risks. Mitigation plans 
are in place to address the program risks. The program meets regularly with Head- 
quarters leadership to review status and progress toward milestone events. The pro- 
gram is engaged with the CBP parallel effort to execute the coordinated strategy 
for both agencies to obtain mainframe independence from the shared legacy TECS 
system. 

Question 2a. Does DHS believe that they are full partners in the FirstNet effort? 

Answer. Yes, DHS is a full partner and one of three permanent board members 
in the FirstNet effort. The Department appreciates the importance of the FirstNet 
network to the overall security and resilience of our Nation’s public safety commu- 
nications infrastructure. 

Question 2b. What is DHS doing to support FirstNet? 

Answer. DHS is taking an active role in supporting FirstNet by providing the fol- 
lowing products and services: 

• FirstNet Consultation Preparation Workshops. — DHS has delivered on-site 
workshops in 54 of 56 StatesATerritories to help prepare for the FirstNet con- 
sultation process. The remaining two States/Territories will be completed this 
year. 

• Broadband Tools. — DHS has developed a mobile data survey tool to help States 
determine the current use of commercial and private data systems within their 
jurisdiction that is being leveraged by FirstNet. 

• FirstNet Coordination. — In early 2013, FirstNet asked DHS to participate with 
the National Telecommunications and Information Administration and FirstNet 
staff to coordinate outreach and data collection with public safety efforts. Since 
that time, DHS has participated in weekly calls, as well as periodic strategic 
planning meetings with FirstNet Board members and staff. 

( 55 ) 
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• Federal Broadband Coordination. — The Emergency Communications Prepared- 
ness Center, which is a DHS-led Federal coordination committee to improve 
emergency communications interoperability, has been leveraged by FirstNet for 
Federal outreach and planning. 

• Tribal Coordination. — DHS provided Tribal subject matter expertise to assist 
FirstNet in establishing its Tribal Working Group, as well as facilitating meet- 
ings with key Tribal representatives. 

• Cyber and Physical Risk Assessment. — DHS identified possible threats to and 
vulnerabilities of cyber infrastructure in the Nation-wide Public Safety 
Broadband Network that could threaten the network’s reliability and security. 

• Public Safety Broadband Requirements. — DHS helped develop first responders 
requirements for the Nation-wide public safety broadband network. 

• 700 MHz Demonstration Network. — DHS helped create a 700 MHz Demonstra- 
tion Network at the National Institute for Standards and Technology Boulder 
Labs to assist with performance, conformance, and interoperability testing of in- 
frastructure, devices, and applications. This public safety demonstration net- 
work and environment for testing allows public safety to better understand the 
new capabilities and challenges created by broadband technologies. 

• Modeling and Analysis for Public Safety Broadband. — DHS is conducting mod- 
eling and simulation research on the deployment of a Nation-wide public safety 
broadband network. This research will provide FirstNet with insight needed to 
make more informed procurement-related decisions. 

Question 3. The Office of Program Accountability and Risk Management (PARM) 
is responsible for DHS’ overall acquisition management across the Department, and 
has work under way to implement an Acquisition Life-Cycle framework for major 
acquisitions. Among other things, this framework outlines key decision events over 
the life of a program. This “waterfall” approach may be fine for most types of acqui- 
sitions; but for IT acquisitions, it promotes longer time frames for delivering capa- 
bilities (often 5-7 years) and increased risk of cost, schedule, and performance 
issues. The Office of the Chief Information Officer (OCIO) is responsible for IT in- 
vestment governance, including IT systems development. OCIO has work under way 
to modify, finalize, and implement systems acquisition policies and processes in line 
with an incremental development approach, which calls for breaking programs into 
smaller increments and delivering capabilities in 6-12 month releases. It will be im- 
portant for PARM and OCIO to collaborate on a way forward to define roles and 
responsibilities, and modify the Acquisition Framework as needed to accommodate 
an incremental development approach to IT. How efficiently and effectively do 
DHS’s acquisition and IT governance processes work in concert with one another to 
ensure that major IT investments are delivered within cost and schedule, and meet 
mission needs? 

Answer. DHS’s integrated acquisition and IT governance processes work together 
in an efficient and effective manner. Management Directive 102-01 establishes the 
Department’s acquisition governance framework for both IT and non-IT programs. 
The Management Directorate’s Office of Program Accountability and Risk Manage- 
ment coordinates effective integration and collaboration across the Department’s 
lines of business, including the Office of the Chief Information Officer, to implement 
acquisition oversight. 

Further, the Secretary’s “Strengthening Unity of Effort” initiative is enhancing 
the coordination of Departmental planning, programming, budgeting, and execution 
processes through strengthened requirements processes and decision-making. 

Question 4a. Component agencies of DHS are increasingly using the Government 
Printing Office (GPO) for the production of secure credentials. Some have expressed 
concern that component agencies are inappropriately using Title 44 of the United 
States Code as a means to enter into sole-source agreements with GPO to cir- 
cumvent the normal fair and open competitive procurement process. 

Is there any formal or informal guidance from DHS to component agencies on the 
use of the GPO versus open competition? 

Answer. DHS follows the requirements of Federal Acquisition Regulation 8.802, 
which requires printing to be done by or through GPO unless an exception applies. 
DHS utilizes a form (DHS 500-7) for its components to use to obtain printing serv- 
ices through the designated central printing authority or to seek a waiver. There 
is no additional acquisition guidance regarding printing. 

Question 4b. What is the opinion of DHS Office of General Counsel on Title 44 
of the United States Code and FAR 48 Subpart 8.8 as it relates to public printing 
services and use of GPO for secure credentials? 

Answer. The Department recognizes the statutory and regulatory requirements 
related to the Government Printing Office. 



57 


Question 4c. What risk/security analysis has been done to make sure that secure 
credentials being used by DHS are durable, secure, and virtually counterfeit-proof? 

Answer. A risk/security analysis of the secure credentials used by DHS was con- 
ducted by the General Services Administration (GSA), as the executive agent for ac- 
quisition of Homeland Security Presidential Directive — 12 products and services. 
GSA ensures that secure credentials meet the standards of the National Institute 
of Standards and Technology (NIST). 

To further deter counterfeiting of the secure credentials being used by DHS, the 
Department has gone beyond the NIST requirements by requiring visual security 
features with micro-text bands, the use of transparent and gradient effects, optically 
variable ink, and holographic images in the security laminate. 

Question 4d. What alternatives analysis or analysis of alternatives (including cost 
and security analysis) has been done to support secure credential programs? 

Answer. During an analysis of alternatives conducted by the DHS Office of the 
Chief Security Officer, it was determined that GPO met standards for secure creden- 
tials. GPO delivered added value with strict adherence to a secure Government sup- 
ply chain requirement and smart card product manufacturing. GPO also dem- 
onstrated oversight of security in the transportation of raw materials and finished 
goods, and the physical security of the card manufacturer’s plant and information 
technology systems. 

Question 4e. How much has DHS obligated and expended in fiscal year 2010-fis- 
cal year 2013 for secure credentials printed by GPO? How much does DHS plan to 
spend on secure credentials in fiscal year 2014? 

Answer. DHS has obligated and expended a total of $7,494,875 between fiscal 
year 2010-fiscal year 2013. The breakdown per fiscal year is as follows: 

Fiscal year 2010: $1,769,962.00 
Fiscal year 2011: $1,891,963.00 
Fiscal year 2012: $2,432,350.00 
Fiscal year 2013: $1,400,600.00 
Fiscal year 2014 Plan: $2,491,125.00. 

Question 5a. According to news reports from early April, top hiring officials at 
CBP broke Federal civil service laws when they tried to hire three politically con- 
nected but unqualified candidates who were favored by the agency’s then-commis- 
sioner Alan Bersin. Shortly before arriving at CBP, Mr. Bersin allegedly gave the 
human resources staff three names and told them he wanted to hire the individuals 
as political appointees. However, the slots for those jobs, known as Schedule C posi- 
tions, were filled. The staff then attempted to hire them into open civil service posi- 
tions at the GS-13 level, as management and policy analysts. 

Who were the people seeking career positions in these reported cases? Are they 
employed by CBP currently? If so, under what hiring authorities? 

Answer. The Office of Special Counsel (OSC) has released a press statement re- 
garding its complaint for disciplinary action before the Merit Systems Protection 
Board (MSPB), filed against Katherine Coffman. The OSC has not yet made the 
complaint a public document and DHS is not a party to the litigation. Further, in 
accordance with DHS practice, and per OSC preference, DHS does not comment on 
pending litigation. DHS does not wish to impede the current adjudication of this 
case by releasing specific information relevant to the MSPB proceeding, or by pro- 
viding opinions regarding any specific allegations or evidence that may be contained 
within the complaint as described in the public press statement. Therefore, in this 
and subsequent responses, DHS will only answer as to matters not at issue in the 
litigation. 

Question 5b. Who within the DHS Office of the Chief Human Capital Officer re- 
jected most of the career conversion requests and approved the one 0PM later re- 
jected? Please provide necessary documents asking for and rejecting these personnel 
actions. 

Answer. Please see above. 

Question 5c. Since Ms. Katherine Coffman is in the position to hire individuals 
across CBP, does she assert inappropriate influence over the career civil service hir- 
ing process? Did she or does she seek to hire others who fit “political criteria” fa- 
vored by her or Mr. Bersin? 

Answer. Please see above. 

Question 5d. What was the role of the Office of the White House Liaison at DHS 
in these career conversions? Is the Office of the White House Liaison involved in 
interviewing or vetting other career candidates for Federal employment? 

Answer. DHS has inquired of the relevant individuals and reviewed the relevant 
files and has no reason to believe the Office of the White House Liaison was in- 
volved in the attempted conversion from political appointments to career appoint- 
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ments for the three individuals whom it is alleged Mr. Bersin wanted to hire at 
CBP. 

I am informed it is not. 

Question 5e. Since January 21, 2009, how many political appointees have been 
converted to career employees? if any, please identify them along with their titles 
and the office in which they are working. 

Answer. Prior to January 2010, Federal agencies had to seek OPM’s approval of 
conversions to competitive service positions only during Presidential election years. 
As a result, DHS did not maintain DHS-wide records specific to such conversions 
and cannot readily access this information for the time period between January 21, 
2009 and December 31, 2009. 

Beginning on January 1, 2010, 0PM required agencies to seek prior approval from 
0PM before appointing a current or recent political appointee to a competitive or 
non-political excepted service position at any level under the provisions of title 5, 
United States Code. 0PM provided DHS with information based on OPM’s records 
which establish that since January 2009, six political appointees have been con- 
verted to career positions. 

In 2009, an individual was appointed to a GS-14 policy analyst position in the 
Office of Civil Rights & Civil Liberties. In 2011, an individual was appointed to a 
Senior Executive Service position in the Office of Science and Technology. In 2012, 
an individual was appointed to a Senior Executive Service position in the Federal 
Emergency Management Agency and another individual was appointed to a GS-13 
external affairs specialist position, also in FEMA. In 2013, two individuals were ap- 
pointed to two different Senior Executive Services positions; one in the United 
States Coast Guard and another in the Office of the General Counsel. 

Question 5f. Given the allegations in this matter, do you have confidence in Mr. 
Bersin as a senior leader of DHS? Have you considered putting Mr. Bersin or Ms. 
Coffman on administrative leave while these allegations are fully investigated by 
the Office of Special Counsel and the Merit Systems Protections Board? 

Answer. Yes, the leadership of the Department has full confidence in Mr. Bersin. 

Neither the Office of the Special Counsel (OSC) nor the Merit Systems Protection 
Board (MSPB) has suggested such an action, and DHS has determined not to take 
such action at this time. 

The current posture of the proceedings is that the OSC has completed its inves- 
tigation and filed complaints seeking disciplinary action against three CBP career 
officials. The MSPB has jurisdiction over the complaints. DHS is not aware that 
OSC or the MSPB will conduct any further investigation. 

Question From Honorable Patrick Meehan for Alejandro N. Mayorkas 

Question. I submitted a question for the record following Secretary Johnson’s first 
appearance before the committee that remains unanswered regarding EAGLE II, an 
information technology multiple-award contract vehicle potentially worth $22 billion 
over 5 to 7 years. It is my understanding that companies were notified of additional 
awards being made in early May on highly protested functional category one of the 
vehicle. The announcement appears to cut both ways — more vendors means more 
competition, but also more proposals to evaluate thus slowing down the acquisition 
selection process. 

What information have you received about this procurement and what is your im- 
pression of how this acquisition was conducted? How is DHS going to make sure 
that programs actually use this vehicle and that proposals received per task order 
will be evaluated in a timely manner? 

Answer. As Deputy Secretary, I was not personally involved in this procurement 
and therefore have only had access to publicly-available information in accordance 
with Federal regulation. I have been made aware of the award information and am 
informed that the procurement was conducted in an open and transparent manner, 
emplo 3 dng Federal procurement best practices and in accordance with the Federal 
Acquisition Regulation. Like its predecessor, EAGLE II attracted significant interest 
from industry. 

I am further informed that, since the EAGLE II competition received a robust in- 
dustry response, completing a fair and detailed evaluation of each of the proposals 
required a significant amount of time and resources. Protests are part of the pro- 
curement process for these large competitions. The DHS personnel responsible for 
the EAGLE II procurement participated transparently and professionally in the pro- 
test process to ensure all companies had an opportunity to have their concerns ad- 
dressed in an impartial forum. 

To date, several protests have been dismissed and contract awards have been 
made to large, small, service-disabled veteran-owned, HUBZone, and 8(a) American 
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companies. Task orders have already been placed by several DHS components. Task 
Order awards to date include 18 awards made to various small business totaling 
$16.5 million with a total value of $63.8 million if all option periods are exercised. 

The Office of the Chief Procurement Officer is monitoring EAGLE II spending. 
DHS continues to increase its use of strategic sourcing vehicles such as EAGLE II 
because they provide a streamlined and efficient process for obtaining services and 
result in cost savings for the programs. It is the Department’s policy that the 
EAGLE II contracts be used unless there is an alternative that will 3deld a lower 
price or better support the DHS small business program. 

To streamline task order competitions and evaluations, DHS offers training on the 
use of EAGLE II for all components and has generated an ordering ^ide that in- 
cludes guidance, templates, and points of contact for users. This guidance ensures 
that task order proposals are evaluated promptly and accurately. DHS has a task 
order ombudsman available to assist any EAGLE II contractor that becomes con- 
cerned that a task order proposal evaluation has been delayed. 

Questions From Honorable Tom Marino for Alejandro N. Mayorkas 

Question la. What percentage of NFIP claims from Superstorm Sandy contained 
fraudulent losses? Can you quantify that with a dollar amount? 

Answer. FEMA takes seriously its responsibility to be a good steward of Federal 
funds, which include not only tax dollars but also flood insurance premiums. Reduc- 
ing, investigating, and ultimately eliminating waste, fraud, and abuse is an impor- 
tant part of that responsibility. When FEMA becomes aware of evidence of potential 
fraud on the part of NFIP policyholders, building repair contractors, or others, the 
FEMA Office of Chief Counsel and the Office of the Chief Security Officer’s FEMA 
Fraud Unit work with the Office of the Inspector General to investigate. While the 
FEMA Fraud Unit and the Office of the Inspector General work closely in devel- 
oping cases, FEMA is typically not informed of results as a matter of practice, since 
the issue at hand may be a criminal matter. 

While legally distinct from fraud, FEMA also tracks improper payments pursuant 
to the Improper Payments Act. The tracking does not differentiate underpayments, 
overpayments, or fraud. The results are as follows: 


Fiscal Year 


Improper 
Payment Rate 


2008 

2009 

2010 
2011 
2012 


6.38% 

2.22% 

1 . 21 % 

0.75% 

0.02% 


No, for the same reason explained in the answer above: FEMA is typically not 
informed of investigative results as a matter of practice, since the issue at hand may 
be a criminal matter. 

Question lb. What is the policy for ensuring that claims are legitimate before re- 
leasing funds for rebuilding? 

Answer. There are a number of checks involved in the claims handling process. 
After a claim is filed, the NFIP insurer assigns an independent adjuster, who is cer- 
tified as an NFIP adjuster and has knowledge of the coverage and exclusions under 
the Standard Flood Insurance Policy. The independent adjuster will inspect the in- 
sured property, preferably together with the insured to validate that the adjuster 
reviews all of the components of the property that the insured believes had been 
damaged by flood. The adjuster describes the claim process to the policyholder and 
provides a copy of the NFIP Flood Insurance Claims Handbook, which is a tool de- 
veloped by FEMA to explain the claims process to policyholders after a loss. During 
this inspection, the adjuster measures, photographs, and notes elements of flood 
damage. The adjuster then prepares a detailed room-by-room, line-by-line estimate 
of the damage caused by flood. A report documenting the observed damage is then 
provided for review by the insurer, which is responsible for identifying covered 
losses and making payment. Unless there is an express written waiver, within 60 
days after the loss the insured is required to provide a proof of loss, which is the 
insured’s sworn statement of the amount being claimed. 

Question Ic. Additionally, what tools does the agency have to “claw-back” funds 
released to homeowners who submitted fraudulent claims? 

Answer. All forms of the Standard Flood Insurance Policy (“SFIP”) have provi- 
sions governing improper activities by the insured and void the policy in the event 
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of fraud or misrepresentation. If the policy is void, the NFIP is authorized to recoup 
payments and can do so through a Debt Collection action or affirmative litigation. 
In addition, the United States has available civil and criminal remedies, including 
the False Claims Act, to recoup fraudulently-claimed funds and to seek civil and 
criminal penalties. The DHS Office of Inspector General and other Federal law en- 
forcement, including a FEMA Fraud unit, are available to investigate allegations of 
fraud, and FEMA also will work with State and local law enforcement in appro- 
priate circumstances to investigate and prosecute fraud. 

Question 2. DHS is over 10 years old and it seems that we are only now getting 
to understand what a “high-risk” program is. This is unacceptably long. What took 
so long and what assurances can you give that we won’t have more oversight fail- 
ures going forward? 

Answer. DHS has a clear understanding of its “high-risk” programs, as defined 
on a biennial basis by the Government Accountability Office (GAO) through publica- 
tion of its GAO High-Risk List. We work closely with GAO to address the areas 
where DHS remains on the High-Risk List. When I became deputy secretary of DHS 
in late December 2013, the first action I took was to schedule a meeting with GAO 
Comptroller General Dodaro. DHS and GAO meet regularly to discuss progress on 
our High-Risk designation, and I have been able to participate in several of those 
productive meetings. 

In 2011, DHS published the Integrated Strategy for High-Risk Management 
(Strategy), to address our High-Risk designation. DHS continues to make progress 
towards High-Risk List removal and publishes an updated Strategy on a semi- 
annual basis. Of note is the fact that GAO has stated in its most recent High-Risk 
List update that our Department’s Strategy, “if implemented and sustained, pro- 
vides a path for DHS to be removed from GAO’s High-Risk List.” Further, earlier 
this year we developed specific action plans to address the 30 key outcomes GAO 
identified as part of the management High-Risk area. Our action plans provide 
month-to-month goals that offer a road map to success. Our development of these 
action plans provided us with the opportunity to freshly review our previous efforts 
and, in certain critical areas, to accelerate our time tables materially. 

Question 3. Many of the DHS operating agencies like CBP, TSA, and the Coast 
Guard came with internal inspection capabilities when DHS was created. Yet it ap- 
pears the senior levels have been slow to organize Department-wide oversight. It ap- 
pears that these agencies are not a “part of the whole” from the management per- 
spective. When will DHS-wide management controls be in place? 

Answer. To further Department-wide management integration. Secretary Johnson 
directed the “Strengthening Departmental Unity of Effort” initiative in April 2014. 
In this initiative, the Secretary directs specific activities across four main lines of 
effort: Inclusive senior leader discussion and decision-making forums that provide 
an environment of trust and transparency; strengthened management processes for 
investment, including requirements, budget, and acquisition processes, that look at 
cross-cutting issues across the Department; focused, collaborative Departmental 
strategy, planning, and analytic capability that supports more effective DHS-wide 
decision-making and operations; and enhanced coordinated operations to harness 
the significant resources of the Department more effectively. The goal is better un- 
derstanding of the broad and complex DHS mission space and empowering DHS 
components to effectively execute their operations. 

To that end, the Secretary, in a June 26, 2014 memorandum to DHS leadership, 
established the DHS Joint Requirements Council to “look at cross-component re- 
quirements and develop recommendations for investment, as well as changes to 
training organization, laws, and operational processes and procedures.” This compo- 
nent-led, component-driven body will be organized around the five DHS primary 
mission areas and begin to tackle issues involving information-based screening and 
vetting; chemical, biological, radiological, and nuclear surveillance and detection; 
aviation commonality; cybersecurity; and information sharing with potential impacts 
beginning as early as the DHS budget submission to 0MB this September. Other 
unity-of-effort initiative pieces, including strengthened budget and acquisition proc- 
ess, will also lead to greater management control. 

Question 4. Referring to your technology programs across DHS, there is strong 
criticism from the private-sector suppliers that DHS fails to provide multi-year 
plans that would guide private R&D investment. Why can’t DHS seem to get for- 
ward planning for major programs right? 

Answer. A primary challenge in developing and executing optimal multi-year 
plans to guide private R&D investment is the reality of fiscal uncertainty: The De- 
partment is not assured of sustained funding streams for long-term efforts. 

DHS has worked hard to create a sustainable process to validate Department- 
wide requirements across the DHS primary mission areas to inform investment de- 
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cisions and drive acquisitions. The Secretary’s June 26, 2014 memorandum to DHS 
leadership establishing a DHS Joint Requirements Council to “look at cross-compo- 
nent requirements and develop recommendations for investment, as well as changes 
to training organization, laws, and operational processes and procedures” will help 
us to achieve that goal. I3y studying requirements across components and developing 
“joint” solutions from a range of potential alternative capabilities, the Department 
should be able to more predictably interface with the private sector earlier in order 
to better partner to meet the challenges faced by the Nation in securing the home- 
land. 

Further, the Department’s increased focus on looking at full life-cycle program 
costs across the entire 5-year Homeland Security budget should increase awareness 
and reduce uncertainty for our private industry partners. To this end, newly-con- 
firmed Under Secretary for Science and Technology Dr. Reginald Brothers has also 
prioritized development of an updated Science and Technology Directorate (S&T) 
Strategic Plan complemented by technology roadmaps in S&T’s major investment 
areas. These types of products are fundamental for communicating S&T’s direction 
and vision to industry in order to better align and incentivize private R&D invest- 
ment in DHS and Homeland Security Enterprise needs and priorities. Moving for- 
ward, S&T’s Strategic Plan and roadmaps, along with a revamped approach to cre- 
ating and sharing project requirements, will help strengthen and energize the De- 
partment’s and S&T’s partnership with the Homeland Security Industrial Base. 

Question From Chairman Michael T. McCaul and Ranking Member Bennie G. 

Thompson for Gene L. Dodaro 

Question. Please provide us in writing what you think it would take for the De- 
partment of Homeland Security (DHS) to run seamlessly, all the components within 
the Department using one standard for procurement and other things. 

Answer. DHS could enhance its overall efficiency and effectiveness by continuing 
to implement and strengthen key management initiatives, including fully achieving 
key management outcomes that we and DHS have agreed are necessary for address- 
ing our designation of DHS management functions as high-risk. Achieving some of 
these outcomes will entail implementing Department-wide standards, such as stand- 
ards pertaining to information technology (IT) and acquisition management. 

Specifically, DHS needs to demonstrate continued progress in implementing and 
strengthening key management initiatives and addressing corrective actions and 
outcomes in human capital management, acquisition management, financial man- 
agement, and IT. This includes taking steps to implement certain common stand- 
ards Department- wide. For example, 

• As we reported in May 2014, DHS’s acquisition policy largely reflects key acqui- 
sition management practices, but the Department has not implemented the pol- 
icy consistently. 1 For example, in March 2014, we found that the Transportation 
Security Administration (TSA) does not collect or analyze available information 
that could be used to enhance the effectiveness of its advanced imaging tech- 
nology.2 In March 2014, we also found that U.S. Customs and Border Protection 
(CBP) had not fully followed DHS policy regarding testing for the integrated 
fixed towers being deployed on the Arizona border.® We recommended that CBP 
revise its testing plan in accordance with DHS acquisition guidance, among 
other things. DHS did not concur with our recommendation and stated that the 
existing test plan will provide much, if not all, of the insight contemplated by 
the intent of the recommendation. We continue to believe that revising the test 
plan to include more robust testing to determine operational effectiveness and 
suitability could better position CBP to evaluate integrated fixed-tower capabili- 
ties before moving to full production for the system, help provide CBP with in- 
formation on the extent to which the towers satisfy the Border Patrol’s user re- 
quirements, and help reduce potential program risks. 

• In May 2014, we also reported that work is needed to demonstrate progress in 
implementing IT investment management processes across DHS’s 13 IT invest- 


1 GAO, Department of Homeland Security: Progress Made; Significant Work Remains in Ad- 
dressing High-Risk Areas, GAO— 14-532T (Washington, DC: May 7, 2014). 

®GAO, Advanced Imaging Technology: TSA Needs Additional Information Before Procuring 
Next-Generation Systems, GAO-14-357 (Washington, DC: Mar. 31, 2014). 

® GAO, Arizona Border Surveillance Technology Plan: Additional Actions Needed to Strengthen 
Management and Assess Effectiveness, GAO-1^368 (Washington, DC: Mar. 3, 2014). Integrated 
fixed towers are to consist of surveillance equipment (for example, ground surveillance radars 
and surveillance cameras) mounted on fixed, that is, stationary towers, and power generation 
and communication equipment to support the towers. 
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ment portfolios.'^ In July 2012, we recommended that DHS finalize the policies 
and procedures associated with its new tiered IT governance structure and con- 
tinue to implement key processes supporting this structure.® DHS agreed with 
these recommendations; however, as of April 2014, the Department had not fi- 
nalized the key IT governance directive, and the draft structure had heen imple- 
mented across only 5 of the 13 investment portfolios.® 

More uniformly implementing these common standards across the Department 
and showing measurable, sustainable progress in implementing other key manage- 
ment initiatives can help DHS more fully address GAO’s high-risk designation. We 
are continuing to review DHS’s progress in these areas and will update our assess- 
ment of DHS’s efforts to address our high-risk designation early next year. 

Question From Honorable Yvette D. Clarke for Gene L. Dodaro 

Question. Some individuals believe that DHS disciplinary practices are inequitable 
and oftentimes arbitrary. For example, there is no Department- wide standard for 
penalties, and the same offense can engender different results without any sound 
reason for this discrepancy. Would you agree that the Department could benefit 
from standardized disciplinary processes? Does not having these processes in place 
have an impact on low morale, for instance? If not, why? 

Answer. We have not specifically assessed the standardization of disciplinary 
practices at DHS, but our work has found that TSA could strengthen its monitoring 
of allegations of employee misconduct. 

In July 2013, we found that TSA could strengthen its monitoring of allegations 
of employee misconduct.'^ Specifically, we found that: 

• According to TSA employee misconduct data that we analyzed, TSA inves- 
tigated and adjudicated approximately 9,600 cases of employee misconduct from 
fiscal years 2010 through 2012. While TSA had taken steps to help manage the 
investigations and adjudication process, such as providing training to TSA staff 
at airports, we found that additional procedures could help TSA better monitor 
the investigations and adjudications process. For example, TSA did not have a 
process for conducting reviews of misconduct cases to verify that TSA staff at 
airports were compl 3 dng with policies and procedures for adjudicating employee 
misconduct. We concluded that without a review process, it is difficult to deter- 
mine the extent to which deficiencies, if any, exist in the adjudications process. 

• Further, we found that TSA did not record all misconduct case outcomes, in- 
cluding outcomes in cases that resulted in corrective action or no penalty, in its 
centralized case management system because the agency had not issued guid- 
ance requiring the recording of all outcomes. We concluded that issuing guid- 
ance to TSA staff at airports about recording all case outcomes in the database 
would emphasize management’s view of the importance of staff including such 
information to provide a more complete record of adjudication decisions. 

• We recommended, among other things, that TSA establish a process to conduct 
reviews of misconduct cases to verify that TSA staff at airports are complying 
with policies and procedures for adjudicating employee misconduct, and develop 
and issue guidance to the field clarifying the need for TSA officials at airports 
to record all misconduct case outcomes in the centralized case management sys- 
tem. DHS concurred with the recommendations, and TSA is taking actions in 
response, such as increased auditing of disciplinary records to help ensure that 
airport staff are complying with policies and procedures for adjudicating em- 
ployee misconduct. 

Question From Chairman Michael T. McCaul for Gene L. Dodaro 

Question. Please elaborate on your comments regarding Congressional committees 
with a jurisdiction on homeland security issues. Specifically, to what extent have re- 
petitive or redundant hearings and briefings (i.e., those involving substantially the 
same subject matter but provided separately to more than one committee) led to in- 
efficiencies and inhibited progress by the Department to address items on the High- 
Risk List? Have these particular hearings and briefings increased over time, in com- 


'‘GAO-14-532T. 

®GAO, Information Technology: DHS Needs to Further Define and Implement Its New Govern- 
ance Process, GAO— 12-818 (Washington, DC: July 25, 2012). 

®The draft structure had heen implemented across the following five portfolios: Intelligence, 
screening, information sharing and safeguarding, enterprise IT services, and enterprise human 
capital. 

^GAO, Transportation Security: TSA Could Strengthen Monitoring of Allegations of Employee 
Misconduct, GAO-13—624 (Washington, DC: July 30, 2013). 
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parison to previous Congresses? Does the fact that multiple components at the De- 
partment lacking authorizations (which have not been enacted due to jurisdictional 
battles) have any effect on the ability of these components and DHS Headquarters 
to enact necessary reforms, since potential necessary authorities are not codified? 

Answer. GAO has not analyzed the impact of hearings and briefings on DHS’s 
ability to address items on GAO’s high-risk list, trends in the number of DHS-re- 
lated hearings and briefings, or the potential effects of the lack of authorizing legis- 
lation on DHS’s ability to carry out necessary reforms. In December 2002, we did 
report that the creation of DHS had raised questions regarding how the Congress 
could best meet its oversight responsibilities, and that DHS would be overseen by 
numerous Congressional committees.® At the time we observed that the Congress 
may wish to explore ways to facilitate conducting its responsibilities in a more con- 
solidated and integrated manner, and noted that whether the Congress did so could 
have an impact on the effective implementation and oversight of DHS. 

In 2003 we designated implementing and transforming the Department of Home- 
land Security as high-risk because DHS had to transform 22 agencies — several with 
major management challenges — into one department, and failure to address associ- 
ated risks could have serious consequences for U.S. National and economic secu- 
rity.® It is noteworthy to recognize, however, that since 2003, DHS has made consid- 
erable progress in transforming its original component agencies into a single depart- 
ment. As a result, in our 2013 high-risk update, we narrowed the scope of the high- 
risk area to focus on strengthening DHS management functions. 

DHS remains on the high-risk list because the Department has not made suffi- 
cient progress addressing GAO’s high-risk removal criteria, such as having a frame- 
work to monitor progress, capacity (having sufficient resources), and demonstrating 
clear, sustained progress. Specifically, our work at DHS has found that the Depart- 
ment has made progress strengthening its management functions, including devel- 
oping policies that provide a framework for addressing management challenges. 
However, we have found in our past work that DHS does not always adhere to its 
own policies. For example, DHS’s acquisition policy largely reflects key acquisition 
management practices, but in September 2012, we found that the Department has 
not implemented the practices consistently. Further, we found that DHS has made 
progress in initiating efforts to validate required acquisition documents.^^ However, 
the Department does not have the acquisition management tools in place to consist- 
ently demonstrate whether its major acquisition programs are on track to achieve 
their cost, schedule, and capability goals. Accordingly, about half of DHS’s major 
programs lack an approved baseline, and 77 percent lack approved life-cycle cost es- 
timates. 


Question From Honorable Jeff Duncan for Gene L. Dodaro 

Question. The Office of Program Accountability and Risk Management (FARM) is 
responsible for DHS’s overall acquisition management across the Department, and 
has work underway to implement an Acquisition Life Cycle framework for major ac- 
quisitions. Among other things, this framework outlines key decision events over the 
life of a program. This “waterfall” approach may be fine for most types of acquisi- 
tions; but for IT acquisitions, it promotes longer time frames for delivering capabili- 
ties (often 5-7 years) and increased risk of cost, schedule, and performance issues. 
The Office of the Chief Information Officer (OCIO) is responsible for IT investment 
governance, including IT systems development. OCIO has work underway to modify, 
finalize, and implement systems acquisition policies and processes in line with an 
incremental development approach, which calls for breaking programs into smaller 
increments and delivering capabilities in 6-12 month releases. It will be important 
for FARM and OCIO to collaborate on a way forward to define roles and responsibil- 
ities, and modify the Acquisition Framework as needed to accommodate an incre- 
mental development approach to IT. How efficiently and effectively do DHS’s acqui- 
sition and IT governance processes work in concert with one another to ensure that 
major IT investments are delivered within cost and schedule, and meet mission 
needs? 

Answer. We have found in our prior work that DHS has not yet fully established 
or finalized its acquisition and IT governance processes; however, we found that 


® GAO, Homeland Security: Management Challenges Facing Federal Leadership, GAO— 03-260 
(Washington, DC: Dec. 20, 2002). 

®GAO, High-Risk Series: An Update, GAO— 03— 119 (Washington, DC: Jan. 1, 2003). 

I*’ GAO, High-Risk Series: An Update, GAO-13-283 (Washington, DC: Feb. 14, 2013). 

GAO, Homeland Security: DHS Requires More Disciplined Investment Management to Help 
Meet Mission Needs, GAO— 12-833 (Washington, DC: Sept. 18, 2012). 
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these processes, as defined and implemented thus far, may be leading to slowed IT 
development work, as well as ineffective or redundant executive oversight reviews. 
For example: 

• Slowed IT development work. — In our May 2014 report on agencies’ IT incre- 
mental development policies and approaches, we found that DHS OCIO officials 
had cited inefficient governance and oversight processes as one common factor, 
among others, inhibiting incremental development during a 6-month period. 
To illustrate, those officials said that it can take up to 2 months to schedule 
a meeting with DHS review boards prior to releasing functionality. However, we 
also reported that a Program Accountability and Risk Management (FARM) of- 
ficial disagreed with that statement, maintaining that DHS’s acquisition review 
boards perform reviews very quickly, and that any delays in completing these 
reviews are attributable to investments being unprepared. Further, DHS OCIO 
officials suggested that oversight of programs using an Agile development meth- 
odology should be performed at the lowest practicable level of the organiza- 
tion. Regardless of the cause, these inefficiencies are hampering DHS’s ability 
to deploy IT capabilities in 6-month increments. Accordingly, we recommended 
that DHS consider factors that either enable or inhibit incremental development 
when updating the Department’s policies governing incremental IT develop- 
ment. DHS concurred with our recommendation and stated that it plans to in- 
clude strategies in its guidance to minimize factors identified as inhibiting in- 
cremental development. It will be important for DHS’s OCIO and FARM offices 
to work collaboratively to effectively address this recommendation. 

• Ineffective or redundant executive oversight reviews. — In December 2013, we re- 
ported on the effectiveness of the executive governance and oversight of the De- 
partment’s two TECS modernization (TECS Mod) border security programs. 
While we found that OCIO and FARM had taken actions to oversee the two pro- 
grams, the lack of complete, timely, and accurate data had affected their ability 
to make informed and timely decisions, thus limiting their effectiveness in sev- 
eral cases. For example, we found that OCIO had rated one of the programs 
as moderately low-risk in its most recent program health assessment, based 
partially on U.S. Customs and Border Frotection’s use of earned value manage- 
ment. However, the program manager told us that the other program was not 
using this management technique. In addition, FARM had rated the other pro- 
gram as low-risk in its most recent Quarterly Frogram Accountability Report 
based in part on outdated cost and schedule estimates. Accordingly, we made 
a recommendation to improve the data used by these governing bodies for major 
IT acquisition programs. DHS concurred and stated that it has taken steps to 
ensure that the data used by the IT program acquisition programs are accurate 
and complete, such as implementing a decision support tool. However, we iden- 
tified instances where DHS governance and oversight bodies were acting on in- 
formation that was not complete, timely, or accurate, despite the presence of 
such a tool. 

In addition, while both FARM and OCIO have responsibility for ensuring that 
IT system acquisition programs are on track, it is not always clear whether 
these roles are distinct. Our December 2013 review also showed overlap in the 
program assessments conducted by FARM and OCIO — in particular, with re- 
gard to risk and requirements management, and cost and schedule perform- 
ance. We recently initiated a review to, among other things, assess FARM’S co- 
ordination efforts with DHS components (including OCIO) to conduct oversight 
of major acquisitions. 

Additionally, as we testified in May 2014, the Department has yet to finalize its 
key IT governance directive, and the draft structure has been implemented across 
only 5 of the 13 IT investment portfolios. It will be critical for DHS to complete 


^^GAO, Information Technology: Agencies Need to Establish and Implement Incremental De- 
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these actions in order to ensure that all IT investments are appropriately aligned 
with the Department’s enterprise architecture (i.e., to avoid acquiring duplicative or 
overlapping systems), adequately overseen to ensure that key IT management con- 
trols (e.g., requirements management) are being properly implemented and mon- 
itored, and delivered as planned. Because both FARM and OCIO play important 
roles in ensuring that IT investments are effectively acquired and implemented, 
these two organizations will need to work closely together to ensure that IT projects 
are delivered incrementally and often and that DHS finalizes the IT governance di- 
rective. 


Question From Honorable Tom Marino for Gene L. Dodaro 

Question. In your testimony you mention that the National Flood Insurance Pro- 
gram (NFIP) has not made a single pa3Tnent on the principal borrowed from the 
Department of the Treasury since 2010. Under current law, could you estimate 
when the NFIP would, or could, fully repay the amount owed to the Treasury? 

Answer. We have not made our own estimates of how long the Federal Emergency 
Management Agency (FEMA) would need to repay the $24 billion it has borrowed 
from Treasury for the NFIP. Nevertheless, information from a report we issued in 
April 2014 provides some insight into FEMA’s prospects for repayment, In that 
report, we noted that the Biggert-Waters Flood Insurance Reform Act of 2012 
(Biggert-Waters Act) requires FEMA to issue a report to Congress setting forth op- 
tions to repay FEMA’s total debt to Treasury within 10 years. Although the report 
was due in January 2013, FEMA has not yet issued such a report. FEMA officials 
told us that before the enactment of the Homeowner Flood Insurance Affordability 
Act of 2014 (2014 Act), they had conducted preliminary analysis assessing FEMA’s 
repayment ability under scenarios that use different assumptions about future NFIP 
losses. The officials said the assessment showed that, under FEMA’s planned im- 
plementation of the Biggert-Waters Act, the agency would not reach the 10-year re- 
payment goal under any of the scenarios. Implementation of the 2014 Act may fur- 
ther reduce the likelihood of repayment within 10 years because the Act reduces fu- 
ture program premium revenue by reinstating subsidized and grandfathered rates 
the Biggert-Waters Act had eliminated. 

Our April 2014 report also noted that, according to FEMA officials, in some years 
the agency has not had sufficient funds to make principal payments and, in other 
years, could have made principal payments but chose to preserve its cash balances 
to help avoid the need for future borrowing. A key factor affecting FEMA’s future 
borrowing needs and ability to repay its debt is future losses. However, the fre- 
quency and severity of future flood losses are difficult to predict. 

Questions From Chairman Michael T. McCaul for John Roth 

Question 1. In your testimony, you highlighted a November 2012 audit where the 
Department of Homeland Security (DHS) Office of Inspector General (OIG) tested 
DHS radios to determine whether DHS components could talk to each other in the 
event of a terrorist event or other emergency. Only 1 of 479 radio users tested — 
or less than one-quarter of 1 percent — could access and use the specified common 
channel to communicate. Further, of the 382 radios tested, only 20 percent (78) con- 
tained all the correct program settings for the common channel. You testified that 
the reason the response rate was so low was that DHS did not establish an effective 
governing structure with the authority and responsibility to ensure it achieved De- 
partment-wide, interoperable radio communications. What is needed for DHS to es- 
tablish an effective governing structure to solve this problem? What progress has 
DHS made since the report in ensuring operators know how to properly use their 
radio? 

Answer. According to the Office of Management and Budget, an effective gov- 
erning structure includes clearly-defined areas of responsibility, appropriately dele- 
gated authority, and a suitable hierarchy for reporting. DHS created working 
groups, committees, and offices to explore Department-wide communication issues, 
including interoperability. However, none had the authority to implement and en- 
force their recommendations. DHS must establish a structure that has actual au- 
thority to enforce recommendations. 

DHS prepared a draft DHS Communications Interoperability Plan (DCIP). As of 
today, the DCIP is still in draft. According to the DCIP, as we pointed out in our 


I® GAO, Economic Development: Overview of GAO’s Past Work on the National Flood Insurance 
Program, GAO-14— 297R (Washington, DC: Apr. 9, 2014). 
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report, governance is the critical foundation of all efforts to address communication 
interoperability. Also according to the DCIP, existing agreements governing inter- 
operability do not sufficiently support DHS’ current needs. The Joint Wireless Pro- 
gram Management Office (JWPMO) and the One DHS Emergency Communications 
Committee are coordinating to determine appropriate roles and responsibilities. Ac- 
cording to DHS, on March 17, 2013, the DCIP was briefed to the One DHS Emer- 
gency Communications Committee. It was approved and signed by the Assistant 
Secretary for the National Protection and Programs Directorate; however, the DCIP 
is on hold, pending a review of the Tactical Communications Executive Steering 
Committee (TacCom ESC) and the outcome of H.R. 4289, the Department of Home- 
land Security Interoperable Communications Act. Wording in H.R. 4289 may lead to 
a redefinition of interoperability and reassignment of interoperable responsibilities. 
The estimated date of DCIP signature has been extended from April 14, 2014, to 
the end of fiscal year 2014 (September 30, 2014). This will allow time for the 
TacCom ESC meeting to be scheduled and completed, as well as allow time for any 
requested, additional follow-up briefings. 

Historically, the JWPMO and its predecessor organizations have not had success 
in achieving interoperability. 

Question 2. It appears that the technology is available to achieve interoperable 
communications. Does DHS have the proper infrastructure to use their IT network 
as a way to connect radios and other devices, such as smartphones, in both a com- 
mand center and an operational environment? 

Answer. DHS does not currently have the IT infrastructure to support a 
broadband network in the operational environment. We have not done any work 
specifically looking at this capability, but the available body of knowledge provides 
the following insights. 

• A broadband network could improve incident response, by providing video and 

data not currently available on Land Mobile Radio (LMR) systems; Nation-wide 

access; and interoperability. 

• The Government Accountability Office (GAO) and public safety organizations 
and officials indicate that mission-critical voice communication will not likely 
be available on broadband networks for many years. 

• There is disagreement among industry experts about how soon mission-crit- 
ical voice capability could be available — some industry experts predict voice 
capabilities will be available within a few years, while others project it will 
not be available for at least a decade. 

• Long-term Evolution (LTE), the Federal Communications Commission stand- 
ard for public safety broadband communication, is not currently designed to 
support mission-critical voice communication, such as push-to-talk. 

• GAO has reported other communication limitations associated with 
broadband networks, such as limited network access inside large buildings or 
underground. 

• GAO has reported that any new broadband network could require up to 10 
times the number of towers as current LMR systems because, as a cellular 
network, broadband would use a series of lower power towers to transmit sig- 
nals and reduce interference. 

• Additional towers for the broadband network would also need to be hardened 
to withstand disasters, such as hurricanes. 

• GAO has reported that a broadband network would supplement, rather than 
replace, LMR systems for the foreseeable future. Also, until there is mission- 
critical voice communication, a public safety broadband network will not re- 
solve interoperability issues exacerbated by past emergency responses. 

• DHS approved its TacNet program in March 2011 and directed establishment 

of the JWPMO to coordinate the program. 

• TacNet, a new DHS acquisition program, seeks to leverage public safety 
broadband and commercial networks to develop a single network capable of 
supporting voice, video, and data capabilities through DHS subscriptions to 
LTE public safety and commercial broadband networks. 

• In collaboration with the JWPMO, the DHS Science & Technology Directorate 
plans to award $7.5 million in contracts this fiscal year for a technology dem- 
onstrator program that will offer mission-critical voice capabilities and accom- 
modate DHS video and data needs on a broadband, LTE network. 

• DHS plans to limit upgrading and modernizing its current LMR systems, 
based on DHS priorities and mission-critical needs, to address equipment ob- 
solescence, Federal narrowband and security requirements, and interoper- 
ability standards. 

• DHS has estimated that full modernization of its legacy radio systems to 
meet these requirements would cost about $3.2 billion. In March 2012, DHS 
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awarded a $3 billion Department-wide contract to acquire equipment and 
services needed to maintain, upgrade, and modernize its legacy LMR system. 

Question From Honorable Jeff Duncan for John Roth 

Question. According to an AP news report in 2012, Suzanne Barr, a senior Obama 
administration political appointee at Immigration and Customs Enforcement (ICE), 
resigned amid allegations of inappropriate sexual behavior and cultivating a “frat 
house” atmosphere at ICE. Prior to her resignation, Suzanne Barr was serving as 
chief of staff to former ICE Director John Morton. It appears that an OIG investiga- 
tion was started, but did not continue after Barr resigned. As the newly-confirmed 
DHS inspector general, please explain to the committee what became of this inves- 
tigation and why it appears that the investigation did not continue. 

Answer. The Office of Investigations, Office of Inspector General, did not open an 
investigation into allegations of misconduct hy Suzanne Barr in 2012. We conducted 
a preliminary inquiry as we were made aware of the allegations. We established 
there was an on-going Title VII civil suit filed hy an Immigration and Customs En- 
forcement special agent in charge in New York City claiming harassment and retal- 
iation. This litigation overlapped with the allegations we were aware of. Addition- 
ally, Suzanne Barr resigned in September 2012. Any Office of Inspector General ad- 
ministrative investigation would have been rendered moot as she was no longer a 
DHS employee. 

With regards to an allegation we received in November 2011, in December 2011 
the Office of Inspector General issued a Report of Investigation to then-immigration 
and Customs Enforcement Director John Morton. The investigation was initiated 
based on a referral from Immigration and Customs Enforcement, Office of Profes- 
sional Responsibility alleging that Suzanne Barr and Tracey Bardoff, assistant di- 
rector, Immigration and Customs Enforcement misused Government funds to pay 
for their July 20, 2011 official travel to Mexico City, Mexico and a subsequent per- 
sonal trip to Canciin, Mexico on July 22, 2011. The allegation further stated neither 
attended the official meetings in Mexico City, Mexico. The investigation developed 
no evidence that either Barr or Bardoff misused Government funds. 
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